The Estatik Real Estate Plugin for WordPress versions prior to 4.3.4 does not properly validate the recipient list used by its property request form. This flaw allows unauthenticated attackers to send emails with arbitrary subject, body, and Reply-To headers to arbitrary recipients when the form is set to route messages to a custom address. The vulnerability is classified as CWE-345 (Insufficient Verification of Data Authenticity) and has a CVSS v3.1 base score of 3.7 (low severity) with network attack vector, high attack complexity, no privileges required, no user interaction, and limited impact on integrity only.

An attacker can exploit this vulnerability to send unauthorized emails from the affected site to arbitrary recipients with attacker-controlled content. This could be used for spam or phishing attempts leveraging the trusted domain of the vulnerable site. There is no direct impact on confidentiality or availability, and the integrity impact is limited to the ability to send forged emails.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling or restricting the property request form's ability to route emails to custom addresses to prevent abuse.