Description

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on sites where the form is configured to route to a custom address.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-12T12:17:47.443Z",
  "pubdate": "2026-08-12T12:17:47.443Z",
  "executiveSummary": "An arbitrary email relay vulnerability exists in the Estatik Real Estate Plugin for WordPress before version 4.3.4.\nThe vulnerability allows unauthenticated remote attackers to leverage the property request form to transmit arbitrary email messages to arbitrary recipients.\nThe root cause stems from a lack of validation regarding the recipient list used to address outbound messages versus the configured target address.\nImpact includes the potential abuse of the vulnerable WordPress site as a spam relay, phishing vector, or social engineering platform capable of spoofing subjects, bodies, and Reply-To headers.\nExploitation requires the target site to have the property request form specifically configured to route notifications to a custom address, and attackers do not require any privileges or authentication to interact with the vulnerable endpoint.",
  "technicalDetails": "The vulnerability resides within the property request form functionality of the Estatik Real Estate Plugin affecting versions prior to 4.3.4.\nThe root cause of the flaw is the application's failure to properly validate or sanitize the recipient list against the originally intended custom destination address configured by the site administrator.\nWhen a property request form is configured to route messages to a custom address, the backend processing logic accepts user-supplied parameters without ensuring that the transmission envelope aligns with the constrained administrative recipient definitions.\nThe attack flow proceeds as follows: an unauthenticated remote attacker identifies a vulnerable WordPress instance running an affected version of the Estatik Real Estate Plugin where the property request form routes to a custom address.\nThe attacker crafts an HTTP request targeting the form submission endpoint, injecting arbitrary data into the parameters controlling the email subject, body content, and Reply-To headers.\nFurthermore, the attacker supplies an arbitrary recipient address to the input vector.\nDue to insufficient input validation and recipient restriction enforcement, the underlying mail-sending function processes the user-supplied payload.\nThe application constructs and dispatches the outbound SMTP or PHP mail message containing the attacker-controlled subject, body, and headers directly to the arbitrary recipient specified in the request.\nNetwork exposure is fully remote and accessible over the public internet via standard HTTP/HTTPS protocols interacting with the WordPress plugin endpoints.\nAuthentication requirements are absent, allowing completely unauthenticated users to trigger the mail relay functionality.\nPrivilege requirements are nonexistent, as no administrative or subscriber roles are needed to submit the property request form.\nPost-exploitation impact includes the weaponization of the affected WordPress site for spam campaigns, distribution of malicious phishing payloads, and reputation damage resulting from the server being blacklisted as an active spam source."
}