CVE-2026-14547 describes an improper authentication vulnerability (CWE-287) in the Estatik Real Estate Plugin for WordPress versions prior to 4.3.3. The plugin fails to enforce its anti-spam mechanisms and does not restrict recipient routing in its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary content. This effectively turns the affected site into an open mail relay, which can be abused for spam or phishing attacks. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts integrity but not confidentiality or availability.

The vulnerability allows unauthenticated attackers to send arbitrary emails from the affected WordPress site, potentially enabling spam or phishing campaigns that appear to originate from a legitimate domain. This can damage the reputation of the site owner and may lead to blacklisting of the domain or IP address. There is no direct impact on confidentiality or availability of the site itself.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting the property request form functionality or implementing additional email sending restrictions to prevent abuse. Monitor for updates from the plugin vendor regarding a security patch or official mitigation.