CVE-2026-18044 — LOW (3.7) — White Hats Nepal

Vulnerability Description

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on sites where the form is configured to route to a custom address.

CVSS Score

3.7

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE

Related Weaknesses (CWE)

CWE-345

References

https://wpscan.com/vulnerability/87623f1e-c0fa-4563-af13-68e51ba2d7a9/

FAQ

What is CVE-2026-18044?

CVE-2026-18044 is a vulnerability with a CVSS score of 3.7 (LOW). The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthentic...

How severe is CVE-2026-18044?

CVE-2026-18044 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-18044?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.