EUVD-2026-51404
GHSA-cfr3-ggcx-jjf3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable init-hook endpoint (AV:N), static documented default credentials give effectively no auth (PR:N) and low complexity (AC:L), file upload yields full RCE and thus C/I/A:H.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint authenticated solely by static, plugin-seeded API credentials that are identical across all installations. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The WPL I/O service endpoint is registered on the public WordPress init hook with no WordPress capability check, and the required api_key and api_secret values are static defaults seeded by the plugin's own SQL migration files, meaning any unauthenticated attacker who knows these publicly documented defaults can reach and exploit the vulnerable upload path.
Articles & Coverage 2
AnalysisAI
Unauthenticated remote code execution in the Realtyna Organic IDX / WPL Real Estate WordPress plugin (all versions through 5.2.0) lets attackers upload executable PHP files through the plugin's I/O service. The upload function skips file-type validation, and the endpoint is guarded only by static api_key/api_secret defaults that ship identically in every installation via the plugin's SQL migration files, so any attacker who knows these publicly documented credentials can reach it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Realtyna Organic IDX + WPL Real Estate plugin (≤5.2.0) is installed and active, and that the WPL I/O service endpoint is reachable over the network - both true by default. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals align strongly toward high real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker looks up Realtyna WPL's publicly documented default api_key and api_secret, then sends a crafted request to the WPL I/O set_property upload action carrying a small PHP webshell as the uploaded file. Because there is no capability check on the init-hook endpoint and no file-type validation, the shell is written to a web-accessible directory; the attacker then browses to it to execute commands as the web server user. … |
| Remediation | Upgrade to the vendor-released version that fixes CVE-2026-14483 as soon as it is published; because the input does not include an exact fixed version number, treat any release later than 5.2.0 as the target and confirm the fixed version against the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/23068a98-623d-4eb3-a7c5-6af410de4320?source=cve) before deploying - no vendor-released patch version is independently confirmed from the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all WordPress installations running WPL Real Estate plugin version 5.2.0 or earlier and isolate them as critical-risk systems requiring urgent action. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file upload leading to remote code execution exists in Realtyna Organic IDX plugin + WPL Real
Arbitrary file upload in the Realtyna Organic IDX (WPL Real Estate) plugin for WordPress affects all versions up to and
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today