Description

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-07T06:16:56.387Z",
  "pubdate": "2026-08-07T06:16:56.387Z",
  "executiveSummary": "An unauthenticated Login Cross-Site Request Forgery (CSRF) vulnerability exists in the Estatik Real Estate Plugin for WordPress in versions prior to 4.3.3.\nThe security flaw stems from the failure of the application to properly bind the OAuth social login authentication flow to the initiating user session.\nAn external unauthenticated attacker can leverage this cryptographic or session-binding omission to force a victim browser into authenticating with an attacker-controlled account during the OAuth handshake.\nConsequently, the victim's subsequent application activity, sensitive data submissions, and stored interactions are persistently recorded under the attacker's account context.\nThis architecture flaw allows the adversary to achieve unauthorized data access and session manipulation without requiring prior privileges or complex interaction beyond tricking the victim into navigating to a malicious context.\nThe operational risk is substantial, compromising data confidentiality and integrity by conflating victim user actions with adversary-monitored accounts within real estate operational environments.",
  "technicalDetails": "The vulnerability resides within the OAuth social login implementation of the Estatik Real Estate Plugin affecting all versions prior to 4.3.3.\nThe root cause of the flaw is the complete lack of session state validation, specifically the absence of a cryptographic anti-CSRF state parameter (such as a cryptographically secure nonce or state token) that securely binds the incoming OAuth authorization response back to the specific browser session that initiated the authentication request.\nBecause the OAuth callback mechanism blindly accepts and processes authentication assertions from the identity provider without validating session continuity, an attacker can generate a valid authentication session on their own controlled account and trick a victim into completing the callback phase under that specific security context.\nThe attack flow proceeds as follows: First, the attacker initiates an OAuth login flow using their own attacker-controlled account credentials or identity provider mapping. Second, the attacker intercepts or pre-constructs the resulting callback URL or forces the victim's browser to execute the final steps of the OAuth token exchange sequence linked to the attacker's account identifier. Third, the victim's browser processes this response, authenticating the victim's active browser session into the attacker's pre-configured account on the target WordPress instance.\nOnce the victim is silently logged into the attacker's account, any subsequent actions taken by the victim—such as submitting personal information, uploading documents, saving property searches, or interacting with portal features—are executed within the scope of the attacker's account.\nPost-exploitation impact includes the exposure of sensitive victim data to the attacker, as the adversary maintains direct access to the account where the victim's activity was logged, effectively enabling unilateral data theft, surveillance, and application-layer profiling.\nThe vulnerability is network-exploitable, requires no authentication or privileges for the initial coercion phase, and impacts the web application layer through insecure state management of federated authentication protocols."
}