A high-severity login CSRF vulnerability in the Estatik Real Estate Plugin allows attackers to hijack user sessions and monitor subsequent activity.

This is a Cross-Site Request Forgery (CWE-352) vulnerability in the OAuth social login implementation. By failing to bind the login flow to the initiating session, an unauthenticated attacker can force a victim to authenticate into an attacker-controlled account, exposing the victim's subsequent data submissions to the attacker.

With a CVSS score of 7.5, this vulnerability presents a significant risk to user privacy and data integrity. Successful exploitation allows an attacker to monitor the sensitive real estate data and activities of victims, potentially leading to unauthorized data collection and loss of user trust in the platform.

Immediate Action: Update the Estatik Real Estate Plugin to version 4.3.3 or later to ensure proper session binding during OAuth authentication.

Proactive Monitoring: Review application logs for suspicious login patterns or irregular account activity associated with social login flows.

Compensating Controls: Implement strict SameSite cookie attributes and consider disabling social login features if the update cannot be applied immediately.

Public Exploit Available: No confirmed public exploit exists in our curated data.

This vulnerability highlights the dangers of improper session management in authentication workflows. Security teams should prioritize updating this plugin to the latest version to prevent session hijacking and protect user data from unauthorized surveillance.