CVE-2026-14547

Name of the Vulnerable Software and Affected Versions Estatik Real Estate Plugin versions prior to 4.3.3

Description This issue occurs because the property request form does not properly enforce anti-spam checks or restrict recipient routing. This allows unauthenticated users to send emails to arbitrary recipients with custom subjects, bodies, and Reply-To headers, enabling the site to be used as a mail relay for spam or phishing campaigns.

Recommendations Update Estatik Real Estate Plugin to version 4.3.3 or later.