Realtyna Organic IDX CVE-2026-45439

No special conditions - remote unauthenticated exploitation against default installations of the Realtyna Organic IDX WordPress plugin at version 5.1.0 or earlier, with the plugin activated on a network-reachable WordPress site. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and standard internet network access are required. The only limiting factor is that the target site must actually have this specific plugin installed and active; the vulnerable endpoint must be reachable (not blocked by a WAF or IP allowlist), which is the default for public-facing real-estate sites that rely on the plugin to serve listings.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction - the worst-case prerequisites profile. The S:C (scope change) and C:H confirm the attacker can read sensitive data outside the plugin's intrinsic security context (i.e., other WordPress data such as administrator password hashes and secrets in wp_options). However, I:N and A:L are unusual for SQLi and suggest the underlying query is read-only (e.g., a SELECT into a search endpoint) rather than a path to data modification. No EPSS score, KEV listing, or POC was provided in the input, so real-world exploitation evidence is absent; given the trivially exploitable profile and the historical pattern of mass-scanning unauthenticated WordPress plugin SQLi, opportunistic exploitation is plausible once details propagate. Patchstack disclosure typically coincides with vendor coordination, but no fix version was supplied in the input - this should be verified directly against the Patchstack advisory.

An attacker scans the internet for WordPress sites running the Realtyna Organic IDX plugin (often fingerprintable by characteristic CSS/JS asset paths or listing-page markup) and sends a single crafted HTTP request to a vulnerable plugin endpoint with a malicious parameter that injects a UNION SELECT extracting administrator password hashes and the WordPress auth keys from wp_options. With the hashes offline-cracked or session secrets recovered, the attacker authenticates as administrator and pivots to full site takeover through theme/plugin upload. No POC is referenced in the input data, so the scenario is generic to unauthenticated WordPress plugin SQLi rather than tied to a published exploit.