CVE-2026-13714criticalCWE-434

CVE-2026-13714: critical vulnerability in Realtyna Organic IDX plugin + WPL Real Estate

Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

Published

Follow this CVE+ Monitor Realtyna Organic IDX plugin + WPL Real Estate

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.8epss 0.8%
from disclosure to weapon6 days
Published on NVDJul 27
1st PoC+6d
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Realtyna Organic IDX plugin + WPL Real Estate
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Realtyna Organic IDX plugin + WPL Real Estate

In the same product, most dangerous first.

CVE-2026-91014HIGHRealtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector EndpointEPSS 0.3%