EUVD-2026-51404
GHSA-cfr3-ggcx-jjf3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable init-hook endpoint (AV:N), static documented default credentials give effectively no auth (PR:N) and low complexity (AC:L), file upload yields full RCE and thus C/I/A:H.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint authenticated solely by static, plugin-seeded API credentials that are identical across all installations. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The WPL I/O service endpoint is registered on the public WordPress init hook with no WordPress capability check, and the required api_key and api_secret values are static defaults seeded by the plugin's own SQL migration files, meaning any unauthenticated attacker who knows these publicly documented defaults can reach and exploit the vulnerable upload path.
Articles & Coverage 2
AnalysisAI
Unauthenticated remote code execution in the Realtyna Organic IDX / WPL Real Estate WordPress plugin (all versions through 5.2.0) lets attackers upload executable PHP files through the plugin's I/O service. The upload function skips file-type validation, and the endpoint is guarded only by static api_key/api_secret defaults that ship identically in every installation via the plugin's SQL migration files, so any attacker who knows these publicly documented credentials can reach it. Rated CVSS 9.8 by Wordfence; no public exploit identified at time of analysis, but the trivially reproducible preconditions make exploitation straightforward.
Technical ContextAI
This is a CWE-434 (Unrestricted Upload of File with Dangerous Type) flaw in a WordPress plugin. The WPL I/O service is registered on the public WordPress 'init' hook (see io.php and global.php), meaning it executes for every request without any WordPress capability or nonce check. Authentication is delegated entirely to api_key and api_secret values, but those are static defaults seeded by the plugin's own migration SQL (assets/migrations/basic/1.0.0.sql), so they are constant across all deployments rather than per-site secrets. The vulnerable upload path in libraries/file.php (line ~217), reached via the mobile_application/set_property.php I/O action, writes attacker-supplied content to disk without validating extension or MIME type, allowing a .php payload to land in a web-accessible directory and execute.
RemediationAI
Upgrade to the vendor-released version that fixes CVE-2026-14483 as soon as it is published; because the input does not include an exact fixed version number, treat any release later than 5.2.0 as the target and confirm the fixed version against the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/23068a98-623d-4eb3-a7c5-6af410de4320?source=cve) before deploying - no vendor-released patch version is independently confirmed from the available data. As immediate compensating controls where patching must wait: rotate the WPL api_key and api_secret away from the plugin's seeded SQL defaults so the static-credential bypass no longer works (trade-off: any legitimate mobile/IDX I/O integration relying on those defaults will break until reconfigured); block or restrict access to the WPL I/O service endpoint at the WAF or web-server level (Wordfence firewall or an equivalent rule targeting the io.php action and set_property upload, trade-off: may interfere with legitimate IDX feed/mobile sync); and enforce server-side execution restrictions on the upload directory (e.g. deny PHP execution in the plugin's upload path via web-server config) so an uploaded .php file cannot run even if it lands.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Share
External POC / Exploit Code
Leaving vuln.today