Realtyna Organic Idx Plugin Wpl Real Estate
Monthly
Arbitrary file upload in the Realtyna Organic IDX (WPL Real Estate) plugin for WordPress affects all versions up to and including 5.3.0, allowing authenticated attackers with subscriber-level access to write attacker-controlled files to the server and potentially achieve remote code execution. The flaw chains missing extension/content validation in saveLiveImages() with a weak authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. Reported by Wordfence and scored CVSS 8.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote code execution in the Realtyna Organic IDX / WPL Real Estate WordPress plugin (all versions through 5.2.0) lets attackers upload executable PHP files through the plugin's I/O service. The upload function skips file-type validation, and the endpoint is guarded only by static api_key/api_secret defaults that ship identically in every installation via the plugin's SQL migration files, so any attacker who knows these publicly documented credentials can reach it. Rated CVSS 9.8 by Wordfence; no public exploit identified at time of analysis, but the trivially reproducible preconditions make exploitation straightforward.
Unauthenticated arbitrary file upload leading to remote code execution exists in Realtyna Organic IDX plugin + WPL Real Estate for WordPress versions before 5.3.0. The file upload API, enabled by default, authenticates using hardcoded credentials identical across all installations and lacks file type validation, allowing attackers to upload and execute PHP files. Publicly available exploit code increases the likelihood of exploitation.
Arbitrary file upload in the Realtyna Organic IDX (WPL Real Estate) plugin for WordPress affects all versions up to and including 5.3.0, allowing authenticated attackers with subscriber-level access to write attacker-controlled files to the server and potentially achieve remote code execution. The flaw chains missing extension/content validation in saveLiveImages() with a weak authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. Reported by Wordfence and scored CVSS 8.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote code execution in the Realtyna Organic IDX / WPL Real Estate WordPress plugin (all versions through 5.2.0) lets attackers upload executable PHP files through the plugin's I/O service. The upload function skips file-type validation, and the endpoint is guarded only by static api_key/api_secret defaults that ship identically in every installation via the plugin's SQL migration files, so any attacker who knows these publicly documented credentials can reach it. Rated CVSS 9.8 by Wordfence; no public exploit identified at time of analysis, but the trivially reproducible preconditions make exploitation straightforward.
Unauthenticated arbitrary file upload leading to remote code execution exists in Realtyna Organic IDX plugin + WPL Real Estate for WordPress versions before 5.3.0. The file upload API, enabled by default, authenticates using hardcoded credentials identical across all installations and lacks file type validation, allowing attackers to upload and execute PHP files. Publicly available exploit code increases the likelihood of exploitation.