Paper/Archive/CVE-2026-13714

CVE-2026-13714

Unknown Realtyna Organic IDX plugin + WPL Real Estate — Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

EPSS 0.8%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 57.6.576 × 2011.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.

Affected

ProductAffectedFixed inSource

Realtyna Organic IDX plugin + WPL Real Estate< 5.3.05.3.0CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/69f9dcd8-ab3c-46ed-ac6b-2f1db35f8d1f