The Estatik Real Estate Plugin for WordPress versions prior to 4.3.3 contains a CSRF vulnerability (CWE-352) in its OAuth social login implementation. Because the plugin does not bind the OAuth login flow to the initiating user session, an attacker can trick a victim into logging into an attacker-controlled account without their consent. This login CSRF enables the attacker to have the victim's actions recorded under the attacker's account, potentially exposing sensitive user activity data. No official patch or remediation level has been confirmed in the provided data.

An attacker can cause a victim to be logged into an attacker-controlled account, leading to the victim's actions being recorded and accessible by the attacker. This compromises user session integrity and privacy but does not directly disclose confidential data or allow privilege escalation. The impact is rated high due to the potential for misuse of user sessions and data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the OAuth social login feature or applying any recommended temporary mitigations from the vendor. Monitor official Estatik plugin channels for updates.