CVE-2026-16262 Estatik < 4.3.3 - Login CSRF
An attacker can force a victim to log into an attacker-controlled account via OAuth, allowing the attacker to read the victim's subsequent activity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-16262?
CVE-2026-16262 is a high-severity vulnerability in Unknown Estatik Real Estate Plugin, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.
Weakness: CWE-352
Which versions are affected by CVE-2026-16262?
How do I fix CVE-2026-16262?
No fix has been published for CVE-2026-16262 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-16262 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-16262 exists.
Sources
Also known as GHSA-jqr2-6x6h-fvmp.