PT-2026-64841 · WordPress · Organic Idx+1
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin versions prior to 5.3.0
Description
The software fails to validate the type of uploaded files. The file upload functionality is protected by an API that is enabled by default and uses hardcoded credentials that are identical across all installations. This allows unauthenticated attackers to upload arbitrary PHP files, leading to remote code execution (RCE), which is the ability to execute malicious commands on the server.
Recommendations
Update Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin to version 5.3.0 or later.
Exploit
Fix
RCE
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Organic Idx
Wp Realestate