CVE-2026-16262

Executive Summary

CVE-2026-16262 is a Login CSRF vulnerability in the Estatik Real Estate Plugin for WordPress, affecting all versions prior to 4.3.3. The flaw resides in the OAuth social login flow, which fails to bind authentication requests to the initiating user session, enabling an unauthenticated attacker to silently log a victim into an attacker-controlled account. Successful exploitation allows the attacker to harvest all subsequent activity performed by the victim within the WordPress admin panel—including property listings, client data, and transaction details—under a single fraudulent login session.

The vulnerability is remotely exploitable over the network with only a single user interaction (a crafted link or embedded form submission), requires no privileges, and poses a high confidentiality impact with low integrity impact. The Estatik plugin is widely used by real estate agencies, making this a targeted vector for espionage against brokers, property managers, and their clients. A patched version (4.3.3) has been claimed by NVD; however, independent confirmation of the vendor advisory is pending, and immediate mitigation controls are recommended regardless of patch status.

Technical Analysis

The Estatik plugin integrates OAuth-based social login (typically Google, Facebook, or LinkedIn) to allow real estate agents and their clients to authenticate into the WordPress backend. The vulnerability stems from the OAuth flow's state parameter handling—or lack thereof. In a secure OAuth implementation, the state parameter is a cryptographically random, session-bound value sent by the client to the authorization server and validated on the callback. Estatik versions < 4.3.3 omit or ignore this binding, meaning the OAuth callback endpoint does not verify that the user who initiated the login is the same user completing the OAuth handshake.

Attack Surface: The affected endpoint is the OAuth callback URL (e.g., /?oauth=callback&provider=google), which processes the authorization code returned by the OAuth provider. Because the flow lacks CSRF protection (no nonce, no session token, no state parameter), an attacker can hijack the OAuth callback.

Code-Level Mechanism (conceptual): The plugin likely executes logic equivalent to:

// Vulnerable pseudo-code (pre-4.3.3)
public function oauth_callback() {
    $code = $_GET['code'];
    $provider = $_GET['provider'];
    $user = $this->social_login($provider, $code); // logs in as attacker's account
    wp_set_auth_cookie($user->ID);
    wp_redirect(admin_url());
}

In a fixed version (4.3.3), the code should resemble:

// Patched pseudo-code
public function oauth_callback() {
    $state = $_GET['state'];
    if (!wp_verify_nonce($state, 'oauth_login_nonce_' . session_id())) {
        wp_die('Invalid state parameter');
    }
    $code = $_GET['code'];
    $user = $this->social_login($provider, $code);
    wp_set_auth_cookie($user->ID);
    wp_redirect(admin_url());
}

The absence of the state verification or session-nonce check is the root cause. An attacker who has pre-registered an account with the same OAuth provider (e.g., a Gmail account) can craft a URL that initiates an OAuth flow for the victim, captures the victim's interaction, and completes the flow with the attacker's own credentials—resulting in the victim's browser being authenticated as the attacker.

Exploitation Scenarios

Scenario 1: Silent Credential Interception via Malicious Link

1. Reconnaissance: The attacker identifies a WordPress site running Estatik < 4.3.3 via Shodan dork (http.title:"Estatik"). They confirm the plugin version using ?p= enumeration or the readme.txt file.

2. Account Preparation: The attacker creates a free Google account (e.g., attacker.evil@gmail.com) and registers an account on the target WordPress site using Estatik's social login.

3. Weaponization: The attacker crafts a malicious URL:

   https://victim-site.com/?oauth=start&provider=google&redirect=https://accounts.google.com/o/oauth2/auth?...&scope=email&state=attacker_state
   

   They also craft a malicious HTML page with an auto-submitting form that replies to the OAuth callback with the attacker's authorization code:

   <form method="GET" action="https://victim-site.com/?oauth=callback&provider=google">
       <input type="hidden" name="code" value="ATTACKER_AUTH_CODE">
       <input type="hidden" name="state" value="attacker_state">
       <input type="submit">
   </form>
   <script>document.forms[0].submit();</script>
   

4. Delivery: The attacker emails or messages the victim a link to the malicious page, or embeds it in a forum post, enticing them to click it (e.g., "Check this property listing link").

5. Execution: When the victim clicks, the page auto-submits the OAuth callback with the attacker's authorization code. Since the plugin does not verify the state parameter against the victim's session, the plugin exchanges the code for tokens and logs the victim in as attacker.evil@gmail.com—silently setting the victim's WordPress session cookie to the attacker's user ID.

6. Post-Exploitation: The victim is redirected to the WordPress admin dashboard (now authenticated as the attacker). Any subsequent action the victim performs—creating listings, uploading client documents, editing properties, viewing transaction reports—is saved under the attacker's account. The attacker periodically logs into their own account and reads all harvested data, including personal client information (names, phone numbers, email addresses, property details, financial figures).

Scenario 2: CSRF via OAuth Initiation Grooming

1. The attacker sends the victim a legitimate-looking login link that triggers the OAuth flow for the victim, but with a state value predefined by the attacker.
2. The victim completes the OAuth flow with their own provider account (e.g., their Gmail).
3. The attacker intercepts the callback using a browser extension or by poisoning a shared Wi-Fi ARP cache, replying with the attacker's own code.
4. The victim's session is switched to the attacker's account mid-session, and the victim unknowingly continues working under the attacker's identity.

Impact of Exploitation: The attacker gains persistent access to all data the victim creates or views while unaware of the session switch. This includes client PII (personally identifiable information), contract metadata, property valuations, and internal communications—all readable by the attacker under their account.

Impact Assessment

The business impact of CVE-2026-16262 is significant for real estate professionals who handle sensitive client data as part of their daily workflow. The CVSS v3.1 base score is N/A with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. Decomposing this:

• Confidentiality (High): An attacker can read all data entered or accessed by the victim during the hijacked session. This is the dominant impact driver, given the sensitive nature of real estate transactions (contracts, IDs, financial statements).
• Integrity (Low): The attacker may inadvertently corrupt or tamper with low-severity data (e.g., modify a listing description) via the victim's actions, but the rogue session is primarily read-oriented.
• Availability (None): No denial-of-service or data destruction is possible through this flaw.
• Attack Complexity (Low): The OAuth flow is publicly reachable; the attacker does not need special conditions beyond crafting a URL and luring a victim.
• Privileges Required (None): The attacker operates fully unauthenticated.
• User Interaction (Required): The victim must click a link, which is trivial social engineering.

Blast Radius: All WordPress sites running Estatik < 4.3.3 are exposed. The real estate vertical is a high-value target due to the financial and legal sensitivity of transaction data. A successful attack could lead to GDPR violations (fines up to 4% of global turnover), reputational damage, and loss of client trust. Additionally, the harvested data could be sold on dark web marketplaces or used for targeted spear-phishing or property fraud.

Detection Guidance

Sigma Rule

title: OAuth Login State Parameter Missing - Estatik Plugin
id: 7e4a2d3c-5b8f-4e1a-9d2c-6f8a3b1c4d5e
status: experimental
description: Detects OAuth callback requests to Estatik plugin lacking a valid session-bound state parameter, indicating potential Login CSRF exploitation.
logsource:
  category: webserver
  product: apache
  service: access_log
detection:
  selection:
    cs-method: 'GET'
    cs-uri-query|contains|all:
      - 'oauth=callback'
      - 'provider=google'
  filter_known:
    cs-uri-query|contains: 'state='
  condition: selection and not filter_known
level: high
falsepositives:
  - Legitimate OAuth flows if state is sometimes absent in older configurations
  - Older browsers or cached requests

YARA Rule

rule Estatik_Login_CSRF_Detection
{
    meta:
        author = "Valtersit Security Research"
        description = "Detects Estatik plugin files that are vulnerable to Login CSRF CVE-2026-16262"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-16262"
        date = "2026-02-15"
    strings:
        $callback = "oauth_callback" ascii wide nocase
        $provider = "$_GET['provider']" ascii wide nocase
        $no_state = "wp_set_auth_cookie(" ascii wide nocase
        $session_start = "session_start()" ascii wide nocase
    condition:
        $callback and $provider and $no_state and not $session_start
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Estatik Plugin OAuth Callback Without State Parameter (CVE-2026-16262)"; flow:to_server,established; content:"GET"; http_method; content:"/"; http_uri; content:"oauth=callback"; http_uri; content:"provider=google"; http_uri; content:"!state="; http_uri; pcre:"/oauth=callback[^\r\n]*provider=google(?!.*state=)/Ui"; classtype:attempted-user; sid:10016262; rev:1; reference:cve,2026-16262;)

Elastic Detection

sequence by source.ip
  [ http where request.method == "GET" and request.uri contains "oauth=callback" and request.uri contains "provider=google" and not request.uri contains "state=" ]
  [ http where request.method == "GET" and request.uri contains "wp-admin" ]

Splunk SPL Query

index=web sourcetype=access_combined uri_path="*" uri_query="*oauth=callback*" uri_query="*provider=google*" | where NOT uri_query LIKE "%state=%" | stats count by src_ip, uri, status, useragent | sort -count

Wazuh OSSEC Rule

<group name="wordpress,estatik,">
  <rule id="471203" level="12">
    <decoded_as>web</decoded_as>
    <match>oauth=callback</match>
    <match>provider=google</match>
    <regex>(?!.*state=)</regex>
    <description>Estatik OAuth callback without state parameter detected - possible Login CSRF (CVE-2026-16262)</description>
    <group>attack.exploitation,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate Mitigations (within 24 hours):

   • Disable OAuth Social Login: In the Estatik plugin settings, disable all social login providers (Google, Facebook, LinkedIn) until the patch is verified. Use traditional username/password authentication or force users to use email-based magic links.
   • Enforce WordPress Nonces: If the plugin allows custom hook overrides, add a middleware filter to the OAuth callback that rejects any request without a valid wp_verify_nonce() token. Apply this patch via a mu-plugin (Must-Use Plugin) to persist across updates.
   • Block External OAuth Referrers: Implement a WAF rule that blocks requests to /?oauth=callback from external Referer headers that do not originate from the site's own domain or the OAuth provider's domain.

2. Patch/Upgrade Steps:

   • Upgrade Estatik: Navigate to Plugins → Installed Plugins in the WordPress admin, find Estatik, and click Update Now if version 4.3.3 is available. If not, download the updated zip from the Estatik marketplace and manually upload it via Plugins → Add New → Upload Plugin.
   • Verify Patch Integrity: After updating, confirm the file includes/oauth/class-oauth-callback.php (or equivalent) contains a wp_verify_nonce or session-state check. If the callback still accepts requests without a state parameter, the patch is insufficient—apply a custom hook override.
   • Check for Updates: Since patch confidence is 2/4, monitor the Estatik changelog and WordPress plugin directory for confirmation that 4.3.3 has been officially released.

3. Long-Term Hardening:

   • Session-Aware OAuth: Adopt a security plugin (e.g., Wordfence, Sucuri) that enforces session binding for all OAuth flows site-wide, regardless of third-party plugin behavior.
   • Security Audits: Perform quarterly penetration testing on WordPress instances, specifically testing CSRF on authentication endpoints.
   • User Awareness Training: Instruct all real estate agents to never click links in unsolicited emails and to verify the URL of any login page before entering credentials.
   • Monitor for Session Anomalies: Deploy SIEM rules that flag sessions where the WordPress user ID changes without a corresponding logout event, as this indicates a potential session switch.

References

1. NVD Entry: CVE-2026-16262 — https://nvd.nist.gov/vuln/detail/CVE-2026-16262
2. Estatik Official Changelog: https://estatik.com/changelog/ (verify 4.3.3 release notes)
3. WordPress Plugin Directory (Estatik): https://wordpress.org/plugins/estatik/
4. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/
5. OWASP CSRF Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: As of this report, there are no publicly documented threat actor campaigns exploiting CVE-2026-16262. No PoC code has been published, and no exploit has been observed in the wild. However, the vulnerability class (Login CSRF) is a known technique leveraged by espionage-focused actors (e.g., APT groups targeting professional services), and the patch confidence of 2/4 suggests a high likelihood of weaponization once details are confirmed.