WordPress Plugin Vulnerabilities

Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

Description

The plugin does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.

Proof of Concept

Affects Plugins

Plugin icon
real-estate-listing-realtyna-wpl
Fixed in 5.3.0

References

CVE
CVE-2026-13714

Miscellaneous

Original Researcher
Thom Stackhouse
Submitter
Thom Stackhouse
Verified
Yes
WPVDB ID
69f9dcd8-ab3c-46ed-ac6b-2f1db35f8d1f

Timeline

Publicly Published
2026-07-06 (about 21 days ago)
Added
2026-07-06 (about 20 days ago)
Last Updated
2026-07-24 (about 2 days ago)

Other

Published
Title
Published
2024-10-25
Title
Marketing Automation by AZEXO <= 1.27.80 - Authenticated (Subscriber+) Arbitrary File Upload
Published
2024-09-25
Title
Advanced File Manager < 5.2.9 - Authenticated (Subscriber+) Limited File Upload
Published
2018-01-06
Title
LearnDash < 2.5.4 - Unauthenticated Arbitrary File Upload
Published
2025-05-23
Title
eMagicOne Store Manager for WooCommerce < 1.3.0 - Unauthenticated Arbitrary File Upload via set_file()
Published
2026-04-14
Title
WebStack <= 1.2024 - Unauthenticated Arbitrary File Upload