CyberRota Analysis
AI-GeneratedThe Estatik Real Estate Plugin for WordPress prior to version 4.3.4 is vulnerable due to insufficient validation of recipient lists in its property request form, enabling unauthenticated users to send emails to arbitrary recipients with custom subject lines and message bodies. This could lead to potential spam or phishing attacks targeting users of the affected sites. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on sites where the form is configured to route to a custom address.