CVE-2026-13714
Received Received - Intake

Unrestricted File Upload in Realtyna Organic IDX Plugin

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: WPScan

Description
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-13714
EUVD
EUVD-2026-49074

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
realtyna organic_idx_plugin *
wpl_real_estate plugin to 5.3.0 (exc)
realtyna organic_idx_plugin to 5.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Realtyna Organic IDX plugin for WPL Real Estate WordPress plugin before version 5.3.0. It allows unauthenticated attackers to upload arbitrary PHP files due to improper file type validation and a default API protected by hardcoded credentials shared across all installations. This leads to remote code execution on the server.

Detection Guidance

Check if the Realtyna Organic IDX plugin or WPL Real Estate plugin is installed and if its version is below 5.3.0. Use commands like 'wp plugin list' in WordPress or inspect the plugin files directly for version information.

Impact Analysis

An attacker could exploit this to upload malicious PHP files and execute arbitrary code on your server. This could allow them to take control of your website, steal data, or use your server for further attacks. The impact includes potential data breaches, defacement, or malware distribution.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and security. Non-compliance may result in legal penalties, fines, or reputational damage due to exposed sensitive data.

Mitigation Strategies

Update the Realtyna Organic IDX plugin and WPL Real Estate plugin to version 5.3.0 or later immediately. Disable the vulnerable API if possible and review server logs for unauthorized file uploads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13714. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart