CVE-2026-16236

Name of the Vulnerable Software and Affected Versions Realtyna Organic IDX versions prior to 5.3.1

Description The plugin allows authenticated users with subscriber-level access and above to upload arbitrary files to the server. This issue stems from missing file extension and content validation within the saveLiveImages() function, an insufficient authorization check on the get keys() AJAX handler, and a missing authentication check on the REST API import endpoint. Such a flaw may enable remote code execution.

Recommendations Update the plugin to a version newer than 5.3.0. As a temporary mitigation, restrict access to the saveLiveImages() function, the get keys() AJAX handler, and the REST API import endpoint.