WordPress Plugin Vulnerabilities

Realtyna Organic IDX plugin < 4.14.14 - Admin+ Arbitrary File Upload

Description

The plugin is vulnerable to arbitrary file uploads due to missing file type validation. This makes it possible for high privilege users such as admin to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affects Plugins

Plugin icon
real-estate-listing-realtyna-wpl
Fixed in 4.14.14

References

CVE
CVE-2024-38736
URL
https://patchstack.com/database/wordpress/plugin/real-estate-listing-realtyna-wpl/vulnerability/wordpress-realtyna-organic-idx-plugin-4-14-13-arbitrary-file-upload-vulnerability

Miscellaneous

Original Researcher
Peng Zhou
Verified
No
WPVDB ID
c80d4baf-4c13-40f0-98a3-ef156008c5dc

Timeline

Publicly Published
2024-07-11 (about 2 years ago)
Added
2024-07-16 (about 2 years ago)
Last Updated
2024-11-29 (about 1 year ago)

Other

Published
Title
Published
2025-12-02
Title
Modula 2.13.1 - 2.13.2 - Author+ Arbitrary File Upload via Race Condition
Published
2021-03-21
Title
WooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE
Published
2025-07-22
Title
ReachShip WooCommerce Multi-Carrier & Conditional Shipping < 4.3.2 - Authenticated (Contributor+) Arbitrary File Upload
Published
2024-04-22
Title
Newsletters < 4.9.6 - Authenticated (Admin+) Arbitrary File Upload
Published
2024-08-06
Title
Z-Downloads < 1.11.5 - Admin+ Arbitrary File Upload