What is the CVSS score of CVE-2026-57811?

CVE-2026-57811 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Realtyna Organic IDX are affected by CVE-2026-57811?

The Realtyna Organic IDX WordPress plugin (versions 5.2.0 and earlier) contains a critical remote code injection vulnerability (CVSS 10.0) that allows unauthenticated attackers to execute arbitrary…

How to fix or mitigate CVE-2026-57811?

Within 24 hours: immediately disable and remove the Realtyna Organic IDX WordPress plugin (real-estate-listing-realtyna-wpl) versions 5.2.0 and below from all production WordPress instances, then audit access logs and file integrity monitoring for evidence of unauthorized code execution. Within 7 days: conduct full forensic analysis of affected sites including WordPress file integrity verification, database audit logs review, and WAF/IDS log analysis for exploitation attempts; implement IP-based access restrictions to WordPress administrative interfaces. Within 30 days: deploy Web Application Firewall (WAF) rules to block code injection payloads, evaluate and deploy alternative real-estate listing plugins after security review, and implement mandatory plugin vulnerability scanning in your CI/CD pipeline.

Realtyna Organic IDX CVE-2026-57811

EUVD-2026-43423 CRITICAL

Code Injection (CWE-94)

2026-07-13 Patchstack

WordPress RCE Code Injection Wordpress Plugin Realtyna Organic Idx Plugin Realtyna

10.0

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote code injection with low complexity (AV:N/AC:L/PR:N/UI:N) yields full C/I/A on the host; I assess S:U as code executes within the WordPress process rather than crossing a proven security boundary, absent detail justifying scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:25 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

CRITICAL 10.0

DescriptionCVE.org

Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Remote Code Inclusion.This issue affects Realtyna Organic IDX plugin: from n/a through <= 5.2.0.

AnalysisAI

Remote code injection in the Realtyna Organic IDX WordPress plugin (real-estate-listing-realtyna-wpl) affects all versions up to and including 5.2.0, allowing remote attackers to inject and execute arbitrary code (described as 'Remote Code Inclusion') against affected WordPress sites. Patchstack assigned a maximum CVSS 3.1 base score of 10.0 with an unauthenticated network vector and scope change, indicating full compromise of the host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

The affected component is Realtyna Organic IDX, a WordPress plugin (CPE cpe:2.3:a:realtyna:realtyna_organic_idx_plugin) used to integrate MLS/IDX real-estate listing feeds into WordPress sites. The root cause class is CWE-94, Improper Control of Generation of Code ('Code Injection'); the vendor description specifically characterizes it as 'Remote Code Inclusion,' which in PHP/WordPress plugins typically stems from unsanitized user-controlled input flowing into dynamic code execution or file/URL inclusion primitives (e.g. include/require, eval, or callback dispatch). Because WordPress plugins run within the PHP process serving the site, successful injection executes in the web application's context and can pivot to the broader hosting environment, consistent with the S:C (scope changed) rating.

RemediationAI

No vendor-released patch version is identified in the available data - the input specifies affected versions through <= 5.2.0 but does not name a fixed release, so administrators should consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/real-estate-listing-realtyna-wpl/vulnerability/wordpress-realtyna-organic-idx-plugin-plugin-5-2-0-remote-code-execution-rce-vulnerability) and the Realtyna vendor site for any release newer than 5.2.0 and upgrade immediately once available. As interim compensating controls given the unauthenticated RCE risk: deactivate and remove the Organic IDX plugin until a patched build is confirmed (side effect: IDX/MLS listing functionality goes offline); if the plugin cannot be removed, place the site behind a WAF (e.g. Patchstack's virtual patching or equivalent) and restrict access to the plugin's request endpoints and any inclusion/callback parameters (side effect: may block legitimate IDX feed requests and requires tuning); and monitor web and PHP logs for anomalous inclusion or code-execution attempts. Do not rely on authentication as a control since the vector is unauthenticated.