CVE-2026-16262

The affected product is the Estatik Real Estate Plugin for WordPress, affected up to version prior to 4.3.3. The root cause is that the plugin does not bind its OAuth social login flow to the initiating user session, enabling an unauthenticated attacker to perform a login CSRF. An attacker can lo...