Realtyna Organic IDX CVE-2026-16236

Exploitation requires reaching the plugin's file-import path: the get_keys() AJAX action in wpl_ajax.php (insufficient authorization) and/or the api/init.php REST import endpoint (missing authentication check), which feed the saveLiveImages() routine that omits file extension and content validation. Per the CVSS vector (PR:L), an attacker needs at least a subscriber-level authenticated account, so sites permitting open user registration are directly exposed while sites that disable self-registration and restrict accounts raise the bar. The plugin must be installed, active, and at version 5.3.0 or earlier. Note the description also cites a MISSING authentication check on the REST import endpoint, which - if independently confirmed - could permit unauthenticated exploitation and remove the account prerequisite; this should be verified with the vendor.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high impact to confidentiality, integrity, and availability - consistent with file-upload-to-RCE on a WordPress host. Subscriber-level access is trivially obtainable on any site with open user registration, which materially raises exploitability. Signals are partially incomplete: there is no EPSS score, no SSVC decision, and no KEV listing provided, so real-world exploitation is not confirmed and no public POC is identified. Note a tension worth verifying: the description states the REST API import endpoint has a MISSING authentication check, which could enable an unauthenticated path, yet Wordfence assigned PR:L (subscriber) - the practical privilege requirement should be confirmed against the vendor advisory, as an unauthenticated vector would elevate this to critical. Overall this is a genuine high-priority issue for internet-exposed installs due to the low bar and RCE potential, tempered by the plugin's niche footprint.

An attacker registers or acquires a subscriber-level account on a WordPress site running Organic IDX <= 5.3.0, then invokes the under-protected import/AJAX flow so that saveLiveImages() writes a PHP webshell into the plugin's image directory because no extension or content validation occurs. The attacker then requests the uploaded file over HTTP to execute code as the web server user. No public exploit is identified at time of analysis, but the low complexity (AC:L) and lack of required user interaction make weaponization straightforward for a skilled attacker.