Son Van

**Name of the Vulnerable Software and Affected Versions** Realtyna Organic IDX versions prior to 5.3.1 **Description** The plugin allows authenticated users with subscriber-level access and above to upload arbitrary files to the server. This issue stems from missing file extension and content validation within the `saveLiveImages()` function, an insufficient authorization check on the `get keys()` AJAX handler, and a missing authentication check on the REST API import endpoint. Such a flaw may enable remote code execution. **Recommendations** Update the plugin to a version newer than 5.3.0. As a temporary mitigation, restrict access to the `saveLiveImages()` function, the `get keys()` AJAX handler, and the REST API import endpoint.