CVE-2026-14483

Name of the Vulnerable Software and Affected Versions Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress versions prior to 5.2.1

Description An arbitrary file upload issue exists due to missing file type validation in the upload function. The WPL I/O service endpoint is registered on the public WordPress init hook without a capability check and relies on static, plugin-seeded API credentials (api key and api secret) that are identical across all installations. This allows unauthenticated attackers to upload executable files, potentially leading to remote code execution.

Recommendations Update the plugin to a version later than 5.2.0. As a temporary mitigation, restrict access to the WPL I/O service endpoint.