CVE-2026-16236
Received Received - Intake

Arbitrary File Upload in Realtyna Organic IDX WordPress Plugin

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: Wordfence

Description
The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to missing file extension and content validation in the saveLiveImages() function combined with an insufficient authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-16236
EUVD
EUVD-2026-51405

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
realtyna organic_idx to 5.3.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Realtyna Organic IDX plugin for WordPress has a vulnerability that allows arbitrary file uploads due to missing file extension and content checks in the saveLiveImages() function. It also lacks proper authorization on the get_keys() AJAX handler and authentication on the REST API import endpoint. This enables authenticated attackers with subscriber-level access or higher to upload files that could lead to remote code execution on the server.

Detection Guidance

Check for unauthorized file uploads in WordPress directories, especially in the Realtyna Organic IDX plugin folders. Look for unexpected PHP or executable files. Review server logs for suspicious AJAX or REST API requests targeting the vulnerable endpoints.

Impact Analysis

An attacker could exploit this to upload malicious files to your server, potentially gaining control over your WordPress site. This could lead to data theft, defacement, or further compromise of your website and server. The impact includes unauthorized access, data breaches, and disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties, fines, and reputational damage due to exposed sensitive data.

Mitigation Strategies

Immediately update the Realtyna Organic IDX plugin to the latest version if available. If no update exists, disable the plugin until a patch is released. Remove unauthorized files uploaded to the server. Implement strict file upload restrictions and review user roles with subscriber-level access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16236. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart