A critical (CVSS 9.8) arbitrary file upload flaw in the Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress can allow unauthenticated attackers to upload files without type validation, potentially leading to remote code execution on sites running version 5.2.0 or earlier.
What Is It
CVE-2026-14483 is an arbitrary file upload vulnerability (CWE-434) in the Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress, affecting all versions up to and including 5.2.0.
The root cause is two-fold. First, the plugin's upload function performs no file type validation. Second, the WPL I/O service endpoint that reaches that upload path is registered on the public WordPress init hook with no WordPress capability check, and is authenticated solely by static api_key and api_secret values. Those credentials are seeded as defaults by the plugin's own SQL migration files, so installations that have not changed them are likely to share the same values, which appear in the publicly browsable plugin source.
The result: an unauthenticated attacker who knows the default credentials can reach the vulnerable upload path and drop files that may be executable, making remote code execution possible.
Why It Matters
The CVSS 3.1 base score is 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), network attack vector, low complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact. Exploitability scores 3.9 out of a possible 3.9.
Where the authenticating secrets remain at their plugin defaults rather than per-site values, the barrier between an internet-facing installation and code execution is thin. Bugs of this shape, network-reachable, no privileges required, credentials shared across installs, are the kind that lend themselves to broad, automated exploitation, though no such activity has been confirmed for this CVE.
What's Vulnerable
- Vendor: realtyna
- Product: Realtyna Organic IDX plugin + WPL Real Estate (WordPress)
- Affected versions: all versions
<= 5.2.0(semver); default status for other versions is unaffected
No CPE entries were published in the NVD record at time of writing.
Patch Status
The NVD record for CVE-2026-14483 was published 2026-07-31 with vulnStatus: Received and lists no patched version, vendor advisory, or fix reference. This CVE does not appear in the supplied CISA KEV data, so there is no KEV-confirmed active exploitation and no KEV-mandated required action at this time. Consult the Wordfence threat intel entry below for the current remediation status.
Sources
- NVD, CVE-2026-14483 (source: [email protected]), published 2026-07-31
- Wordfence Threat Intelligence entry
- WordPress Plugin Trac; SQL migration seeding default API credentials
- WordPress Plugin Trac,
libraries/file.phpupload function - WordPress Plugin Trac,
libraries/io/global.php - WordPress Plugin Trac,
libraries/io/mobile_application/set_property.php - WordPress Plugin Trac,
libraries/services/io.phpinit hook registration