CVE-2026-16262

Name of the Vulnerable Software and Affected Versions Estatik Real Estate Plugin WordPress plugin versions prior to 4.3.3

Description The plugin fails to bind its OAuth social login flow to the initiating user session. This allows an unauthenticated attacker to perform a login CSRF (Cross-Site Request Forgery), which forces a victim to log into an account controlled by the attacker. Consequently, any subsequent activity performed by the victim is stored in and accessible to the attacker's account.

Recommendations Update the Estatik Real Estate Plugin WordPress plugin to version 4.3.3 or later.