Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
Priority MEDIUM 50CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-434.
Summary
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00831 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Realtyna Organic IDX plugin + WPL Real Estate (Unknown): 5.3.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Realtyna Organic IDX plugin + WPL Real Estate | before 5.3.0 | 5.3.0 | Patch available | CNA |
- Realtyna Organic IDX plugin + WPL Real Estate VendorUnknown Affected before 5.3.0 Fixed in 5.3.0 Patch available CNA
Remediation
- Fix · CNA Realtyna Organic IDX plugin + WPL Real Estate (Unknown) Fixed in 5.3.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-13714
- 2026-10-03 Alias added: GHSA-wvhc-cw3f-mchc
References
Sources
- CVE-2026-13714 · CVE Program
- CVE-2026-13714 · NVD
- FIRST EPSS
- GHSA-wvhc-cw3f-mchc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences