Description
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim-s subsequent activity is stored under and readable by the attacker.
CVSS 7.5EPSS 0.158%Risk 0.76
View source- Published
- 2026-08-07 06:16:56
- Last modified
- 2026-08-07 19:17:37
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H