Description (CNA)
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / Estatik Real Estate Plugin | affected 0 before 4.3.3 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.