Unbound OAuth Session Login CSRF in WordPress Real Estate Plugin

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Estatik Real Estate Plugin contains a critical OAuth implementation flaw where the social login flow fails to bind authentication tokens to the user's session context. This allows attackers to initiate OAuth flows without validating they originated from the victim's browser, enabling login CSRF attacks. When a victim clicks a malicious link, they're silently logged into an attacker-controlled account. Any subsequent actions—property searches, inquiries, contact information submissions—are captured under the attacker's credentials, creating privacy violations and potential account takeover chains. This affects WordPress sites running versions before 4.3.3 that rely on social login functionality, particularly real estate platforms handling sensitive client data.

Casky's 322 mapped skills detect this vulnerability pattern by analyzing session binding failures across TA0001 (Initial Access) and TA0043 (Reconnaissance) techniques. Claude's extended reasoning identifies the absence of CSRF token validation in OAuth redirect handlers and correlates CWE-352 cross-site request forgery patterns with authentication flows. Practitioners would see findings flagging: unvalidated OAuth state parameters, missing session nonce checks in login callbacks, and authentication redirects without origin verification. The platform surfaces how attackers chain reconnaissance activities to craft convincing login flows, then exploit the session binding gap to establish persistence under false identities—allowing teams to prioritize remediation of OAuth state parameter validation and session cryptographic binding before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-16262.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-16262

Casky has 322 skills that investigate the attack patterns behind CVE-2026-16262. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn