CVE-2026-14547

MediumCVSS 5.3/10Last modified Aug 26, 2026

Description

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively using the site as a mail relay for spam or phishing.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Unknown	Estatik Real Estate Plugin	< 4.3.3

References

https://wpscan.com/vulnerability/5c208be8-57db-4f74-8030-398c1eece293/

Timeline

Published: Aug 6, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-145486.5The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, al CVE-2026-145494.3The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, al CVE-2026-14554.3The Whatsiplus Scheduled Notification for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to CVE-2026-145505.3The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifyi CVE-2026-145518.8The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local P CVE-2026-145524.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 th CVE-2026-145538.1The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preservi CVE-2026-145546.5The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, all CVE-2026-145565.4The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form CVE-2026-145579.1The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of its CVE-2026-145587.2The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post me CVE-2026-145599.8The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthe