Arbitrary File Upload Vulnerability in Realtyna Organic IDX and WPL Real Estate Plugin for WordPress
CVE-2026-14483
What is CVE-2026-14483?
The Realtyna Organic IDX and WPL Real Estate plugins for WordPress are susceptible to arbitrary file upload due to inadequate file type validation in the upload function. This vulnerability affects all versions up to and including 5.2.0. The issue arises from a publicly accessible I/O endpoint that uses static plugin-seeded API credentials, which are the same across all installations. This allows unauthenticated attackers to upload potentially executable files, paving the way for remote code execution. Furthermore, the I/O service endpoint is registered on the public WordPress init hook without a proper capability check. Attackers can easily exploit this vulnerability by using publicly documented static credentials to access and manipulate the vulnerable upload path.
Affected Version(s)
Realtyna Organic IDX plugin + WPL Real Estate 0 <= 5.2.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved