CVE-2026-16262 describes a CSRF vulnerability in the Estatik Real Estate Plugin for WordPress prior to version 4.3.3. The plugin does not properly bind its OAuth social login flow to the initiating user session, enabling an attacker to force a victim to log into an attacker-controlled account. This login CSRF can lead to the victim's activity being recorded under the attacker's account, compromising user session integrity and privacy.

An attacker can cause a victim to unknowingly authenticate as the attacker, resulting in the victim's actions and data being associated with the attacker's account. This can lead to unauthorized access to the victim's activity data and potential privacy breaches. There is no indication of remote code execution or privilege escalation from the provided data.

No official patch or remediation guidance is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when interacting with OAuth login flows in this plugin and consider disabling the social login feature if feasible.