CVE-2026-14483
Received Received - Intake

Arbitrary File Upload in Realtyna Organic IDX and WPL Real Estate WordPress Plugins

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: Wordfence

Description
The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint authenticated solely by static, plugin-seeded API credentials that are identical across all installations. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The WPL I/O service endpoint is registered on the public WordPress init hook with no WordPress capability check, and the required api_key and api_secret values are static defaults seeded by the plugin's own SQL migration files, meaning any unauthenticated attacker who knows these publicly documented defaults can reach and exploit the vulnerable upload path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-14483
EUVD
EUVD-2026-51404

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
realtyna organic_idx to 5.2.0 (inc)
wpl real_estate to 5.2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Arbitrary File Upload flaw in the Realtyna Organic IDX and WPL Real Estate WordPress plugins up to version 5.2.0. It allows unauthenticated attackers to upload executable files due to missing file type validation and static API credentials that are identical across all installations. This can lead to remote code execution.

Detection Guidance

Check for unauthorized file uploads in the Realtyna Organic IDX or WPL Real Estate plugin directories. Look for files with unusual extensions or timestamps. Review server logs for requests to the vulnerable I/O endpoint (/wpl-io-service/) with static API credentials.

Impact Analysis

An attacker could exploit this to upload malicious files to your WordPress site, potentially gaining control over it. This could lead to data theft, site defacement, or further attacks against visitors. The high CVSS score indicates severe impact.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face fines or penalties if exploited.

Mitigation Strategies

Immediately update both plugins to the latest version beyond 5.2.0. Disable the vulnerable upload function if no longer needed. Rotate all API keys and secrets. Block external access to the /wpl-io-service/ endpoint via firewall rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14483. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart