Arbitrary File Upload Vulnerability in Realtyna Organic IDX and WPL Real Estate Plugin for WordPress

CVE-2026-14483

What is CVE-2026-14483?

The Realtyna Organic IDX and WPL Real Estate plugins for WordPress are susceptible to arbitrary file upload due to inadequate file type validation in the upload function. This vulnerability affects all versions up to and including 5.2.0. The issue arises from a publicly accessible I/O endpoint that uses static plugin-seeded API credentials, which are the same across all installations. This allows unauthenticated attackers to upload potentially executable files, paving the way for remote code execution. Furthermore, the I/O service endpoint is registered on the public WordPress init hook without a proper capability check. Attackers can easily exploit this vulnerability by using publicly documented static credentials to access and manipulate the vulnerable upload path.

References