Estatik < 4.3.3 – Login CSRF | CVE 2026-16262

Description

The plugin does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.

Proof of Concept

Prerequisites: an administrator has enabled and configured Facebook or Google social login in the plugin settings (with real OAuth app credentials). The attacker holds their own registered account on the target whose email matches their OAuth identity.

1. The attacker initiates the site's Facebook (or Google) OAuth flow and captures the authorization code from the redirect WITHOUT completing the token exchange. OAuth codes are single-use and short-lived (~10 minutes).
2. The attacker delivers this URL to the victim within the code's validity window (e.g. a link in a property-alert email):
   https://victim.example/?auth_network=facebook-login-buttons&code=ATTACKER_CODE
   (Google: auth_network=google-login-buttons)
3. The victim's browser hits the callback; the plugin exchanges the code for the attacker's email, matches it with email_exists(), and issues Set-Cookie: wordpress_logged_in_*=attacker|... with no state or nonce bound to the victim's session (302 to the site URL).
4. The victim is now browsing as the attacker's account; their saved searches, favourites, and inquiries are stored under and readable by the attacker.