What is the CVSS score of CVE-2026-16236?

CVE-2026-16236 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Realtyna Organic IDX are affected by CVE-2026-16236?

The Realtyna Organic IDX WordPress plugin (versions through 5.3.0) contains an arbitrary file upload vulnerability allowing subscriber-level attackers to execute malicious code on affected web…

How to fix or mitigate CVE-2026-16236?

Within 24 hours, immediately deactivate the Realtyna Organic IDX plugin version 5.3.0 and earlier; if operationally infeasible, implement Web Application Firewall rules blocking uploads to plugin directories and restrict new subscriber account creation. Within 7 days, monitor Wordfence and Realtyna security advisories for patched releases, and audit existing subscriber accounts for suspicious activity created during vulnerability exposure. Within 30 days, establish a remediation timeline to either upgrade to a patched version when released or migrate to an alternative WordPress real estate solution.

Realtyna Organic IDX CVE-2026-16236

EUVD-2026-51405 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-31 Wordfence

GHSA-2982-9p75-vfp8

WordPress Authentication Bypass RCE File Upload Wordpress Plugin Realtyna Organic Idx Plugin Wpl Real Estate Realtyna

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable import/AJAX path exploitable by a subscriber (PR:L) with no user interaction and low complexity; file-upload-to-RCE yields high C/I/A on the same host (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 06:51 vuln.today

CVE Published

Jul 31, 2026 - 05:35 cve.org

HIGH 8.8

DescriptionCVE.org

The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to missing file extension and content validation in the saveLiveImages() function combined with an insufficient authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 2 Critical, 13 With POC Aug 01, 2026

AnalysisAI

Arbitrary file upload in the Realtyna Organic IDX (WPL Real Estate) plugin for WordPress affects all versions up to and including 5.3.0, allowing authenticated attackers with subscriber-level access to write attacker-controlled files to the server and potentially achieve remote code execution. The flaw chains missing extension/content validation in saveLiveImages() with a weak authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. Reported by Wordfence and scored CVSS 8.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is a WordPress plugin (cpe:2.3:a:realtyna:realtyna_organic_idx_plugin_+_wpl_real_estate) used to import and display real-estate MLS/IDX property listings. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the saveLiveImages() image-handling routine (idx_property_mapper.php) accepts remote/imported files without validating the file extension or MIME/content type, so a PHP or other executable file can be written into the site's webroot. This is reachable because the get_keys() AJAX handler (wpl_ajax.php) performs an insufficient authorization check and the REST import endpoint (api/init.php) lacks an authentication check, exposing the import/upload path to low-privileged accounts. Because WordPress serves plugin upload directories over HTTP, a written PHP file can typically be requested directly to execute code in the web server context.

RemediationAI

No vendor-released patch version was included in the provided data, so treat a fixed release (expected above 5.3.0) as unconfirmed and consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/4a64f840-8570-4f98-8b72-27bee1607fc2?source=cve and the Realtyna plugin changelog for the exact patched version before updating. Until a confirmed fix is applied, reduce exposure by disabling open user registration or setting the default role so untrusted users cannot obtain subscriber accounts (trade-off: blocks legitimate self-service signups), and use a WAF or web-server rules to block requests to the plugin's AJAX handler (wpl_ajax.php get_keys action) and the plugin REST import endpoint from untrusted sources (trade-off: may break legitimate IDX imports). Additionally, configure the web server to deny PHP execution within the plugin/uploads image directories used by saveLiveImages() (trade-off: none for images, high value against RCE), and if the plugin is not actively serving live listings, deactivate it entirely.