CVE-2026-14547 describes an improper authentication vulnerability (CWE-287) in the Estatik Real Estate Plugin for WordPress. Versions prior to 4.3.3 do not properly enforce anti-spam mechanisms or restrict recipient routing in the property request form. As a result, unauthenticated attackers can send emails with arbitrary subject, body, and Reply-To headers to arbitrary recipients, leveraging the vulnerable site as a mail relay for spam or phishing. No CVSS score or official patch information is currently available, and no known exploits are reported in the wild.

The vulnerability allows unauthenticated attackers to abuse the plugin's property request form to send arbitrary emails to arbitrary recipients. This can lead to the site being used as a spam or phishing mail relay, potentially damaging the site's reputation and causing collateral harm to recipients. There is no indication of direct compromise of site data or user accounts from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting access to the property request form to prevent abuse. Monitor for updates from the plugin vendor regarding patches or mitigations.