EUVD-2026-51405
GHSA-2982-9p75-vfp8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable import/AJAX path exploitable by a subscriber (PR:L) with no user interaction and low complexity; file-upload-to-RCE yields high C/I/A on the same host (S:U).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to missing file extension and content validation in the saveLiveImages() function combined with an insufficient authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Articles & Coverage 1
AnalysisAI
Arbitrary file upload in the Realtyna Organic IDX (WPL Real Estate) plugin for WordPress affects all versions up to and including 5.3.0, allowing authenticated attackers with subscriber-level access to write attacker-controlled files to the server and potentially achieve remote code execution. The flaw chains missing extension/content validation in saveLiveImages() with a weak authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires reaching the plugin's file-import path: the get_keys() AJAX action in wpl_ajax.php (insufficient authorization) and/or the api/init.php REST import endpoint (missing authentication check), which feed the saveLiveImages() routine that omits file extension and content validation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high impact to confidentiality, integrity, and availability - consistent with file-upload-to-RCE on a WordPress host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or acquires a subscriber-level account on a WordPress site running Organic IDX <= 5.3.0, then invokes the under-protected import/AJAX flow so that saveLiveImages() writes a PHP webshell into the plugin's image directory because no extension or content validation occurs. The attacker then requests the uploaded file over HTTP to execute code as the web server user. … |
| Remediation | No vendor-released patch version was included in the provided data, so treat a fixed release (expected above 5.3.0) as unconfirmed and consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/4a64f840-8570-4f98-8b72-27bee1607fc2?source=cve and the Realtyna plugin changelog for the exact patched version before updating. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately deactivate the Realtyna Organic IDX plugin version 5.3.0 and earlier; if operationally infeasible, implement Web Application Firewall rules blocking uploads to plugin directories and restrict new subscriber account creation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file upload leading to remote code execution exists in Realtyna Organic IDX plugin + WPL Real
Unauthenticated remote code execution in the Realtyna Organic IDX / WPL Real Estate WordPress plugin (all versions throu
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today