EUVD-2026-43423Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Organic IDX plugin
-
DeliverySend crafted request to vulnerable endpoint
-
ExploitInject code via Remote Code Inclusion
-
ExecutionExecute arbitrary PHP as web user
-
ImpactDeploy web shell and pivot to host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a WordPress site with the Realtyna Organic IDX plugin (real-estate-listing-realtyna-wpl) installed and active at any version up to and including 5.2.0, reachable over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are stated as prerequisites - remote unauthenticated exploitation against a site with the vulnerable plugin enabled. The main limiting factor is deployment: the target must actually run this niche real-estate plugin; the exact vulnerable feature/parameter is not detailed in the available data (only characterized as 'Remote Code Inclusion' / Code Injection), so the precise triggering endpoint should be confirmed from the Patchstack advisory. |
| Impact | The signals are strongly weighted toward high priority: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H describes a remotely reachable, low-complexity, unauthenticated, no-interaction code-injection flaw with scope change and full C/I/A impact, yielding the maximum 10.0 score. However, this assessment is single-sourced from Patchstack, and no independent corroboration (NVD enrichment, EPSS score, SSVC decision, or vendor advisory beyond the Patchstack entry) is present in the provided data. There is no KEV listing and no confirmed POC, so exploitation is not demonstrated in the wild. The primary mitigating reality-check is prevalence: Realtyna Organic IDX is a niche real-estate plugin, so while any single exposed instance is at severe risk, the aggregate attack surface is far smaller than for ubiquitous plugins - EPSS data is absent, so widespread automated exploitation cannot be confirmed or ruled out from this data. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a WordPress site running Realtyna Organic IDX <= 5.2.0, injecting attacker-controlled code (or a remotely included resource) into a vulnerable plugin code path. The injected code executes within the site's PHP process, giving the attacker a web shell and full control of the application, with potential pivot to the hosting environment consistent with the scope-changed rating. No public POC is identified at time of analysis, but the low attack complexity makes exploitation straightforward once the vulnerable path is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 13, 2026
Remote code injection in the Realtyna Organic IDX WordPress plugin (real-estate-listing-realtyna-wpl) affects all versions up to and including 5.2.0, allowing remote attackers to inject and execute arbitrary code (described as 'Remote Code Inclusion') against affected WordPress sites. Patchstack assigned a maximum CVSS 3.1 base score of 10.0 with an unauthenticated network vector and scope change, indicating full compromise of the host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is identified in the available data - the input specifies affected versions through <= 5.2.0 but does not name a fixed release, so administrators should consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/real-estate-listing-realtyna-wpl/vulnerability/wordpress-realtyna-organic-idx-plugin-plugin-5-2-0-remote-code-execution-rce-vulnerability) and the Realtyna vendor site for any release newer than 5.2.0 and upgrade immediately once available. As interim compensating controls given the unauthenticated RCE risk: deactivate and remove the Organic IDX plugin until a patched build is confirmed (side effect: IDX/MLS listing functionality goes offline); if the plugin cannot be removed, place the site behind a WAF (e.g. Patchstack's virtual patching or equivalent) and restrict access to the plugin's request endpoints and any inclusion/callback parameters (side effect: may block legitimate IDX feed requests and requires tuning); and monitor web and PHP logs for anomalous inclusion or code-execution attempts. Do not rely on authentication as a control since the vector is unauthenticated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Realtyna Organic IDX, a WordPress plugin (CPE cpe:2.3:a:realtyna:realtyna_organic_idx_plugin) used to integrate MLS/IDX real-estate listing feeds into WordPress sites. The root cause class is CWE-94, Improper Control of Generation of Code ('Code Injection'); the vendor description specifically characterizes it as 'Remote Code Inclusion,' which in PHP/WordPress plugins typically stems from unsanitized user-controlled input flowing into dynamic code execution or file/URL inclusion primitives (e.g. include/require, eval, or callback dispatch). Because WordPress plugins run within the PHP process serving the site, successful injection executes in the web application's context and can pivot to the broader hosting environment, consistent with the S:C (scope changed) rating.
Know when Realtyna Organic Idx Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated remote code injection with low complexity (AV:N/AC:L/PR:N/UI:N) yields full C/I/A on the host; I assess S:U as code executes within the WordPress process rather than crossing a proven security boundary, absent detail justifying scope change.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Remote Code Inclusion.This issue affects Realtyna Organic IDX plugin: from n/a through <= 5.2.0.
Executive ViewAI
The Realtyna Organic IDX WordPress plugin (versions 5.2.0 and earlier) contains a critical remote code injection vulnerability (CVSS 10.0) that allows unauthenticated attackers to execute arbitrary code on affected WordPress sites. Any organization using this plugin for real-estate listing functionality faces immediate risk of complete website compromise and data breach. Remediation requires urgent plugin removal and comprehensive post-incident investigation.
Until plugin removal is complete, implement Web Application Firewall (WAF) rules to block POST requests containing PHP execution patterns and code injection signatures. Restrict WordPress wp-admin access to known internal IP ranges only, enable comprehensive logging of all file uploads and code inclusion attempts, and isolate affected WordPress instances on a dedicated network segment with egress filtering. Deploy file integrity monitoring (FIM) on wp-content and wp-admin directories, and establish daily automated backups isolated from production networks to enable rapid recovery if exploitation is detected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Realtyna Organic Idx Plugin
View allUnauthenticated SQL injection in Realtyna Organic IDX WordPress plugin (versions 5.1.0 and earlier) allows remote attack
Cross-site scripting in the Realtyna Organic IDX WordPress plugin (versions 5.4.1 and below) allows unauthenticated remo
GitHub PoC
Exploit-DB