External risk intelligence

Realtyna Organic IDX and WPL Real Estate Plugin Arbitrary File Upload Leading to Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-13714

The vulnerability affects a WordPress plugin, which is a type of web application component commonly deployed in internet-facing web server environments. Because the vulnerable functionality is enabled by default and accessible over the network, it is commonly exposed as part of the public web surface.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in a WordPress plugin that handles real estate listings. The flaw allows unauthenticated attackers to upload malicious files, potentially leading to unauthorized code execution on affected websites. The main concern is confirming relevance and exposure.

Unauthenticated attackers can upload harmful files.
Impacts websites using specific real estate plugins.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can upload malicious PHP files to a vulnerable website by exploiting a flaw in the Realtyna Organic IDX and WPL Real Estate WordPress plugins. This occurs because the file upload feature does not properly check file types and is accessible via an API that uses default, hardcoded authentication credentials. Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the server.

No authentication required.
Upload arbitrary PHP files.
Achieve remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to execute arbitrary PHP code on a server when the affected WordPress plugin is installed and its file upload functionality is enabled. This could impact the integrity and availability of the affected website.

Server-side code execution.
Upload arbitrary PHP files.
Website compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Realtyna Organic IDX and WPL Real Estate WordPress plugins, when unpatched, allow unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution due to inadequate file type validation and hardcoded API credentials. Ownership typically falls to the application or platform team managing the WordPress deployment, with immediate action focused on identifying affected sites, assessing their exposure, and confirming the business criticality of the instance. Coordination with the vendor may be necessary for remediation.

Application owners and platform teams.
Verify plugin presence and accessibility.
Plan vendor-coordinated updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Realtyna Organic IDX and WPL Real Estate plugin?

These are WordPress plugins used to manage and display real estate property listings directly on a website. They provide the backend functionality necessary to integrate MLS data and search features, effectively turning a WordPress site into a real estate portal. Because they are designed to interface with public-facing databases and user searches, they often require extensive access to server-side resources to handle listing media and property content updates.

What is the weakness class for CVE-2026-13714?

This vulnerability is classified as CWE-434, which is Unrestricted Upload of File with Dangerous Type. In this specific case, the software fails to verify the format of uploaded files and provides an entry point that lacks proper security controls. This weakness allows an attacker to bypass intended restrictions and upload executable scripts—such as PHP files—directly to the server, which can then be triggered to perform unauthorized actions.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by interacting with the plugin's file upload API. Because the API uses hardcoded credentials that are identical across every installation, no unique authentication is required to access it. Note that simply having the plugin installed is sufficient; the vulnerability is not triggered by user behavior or site configuration, but rather by the presence of the default-enabled API that lacks proper validation for incoming files.

Is my website at risk if it uses this plugin?

According to Halo Surface Signal, this vulnerability is highly relevant because the affected WordPress plugins are commonly deployed in internet-facing environments. Since the vulnerable API is enabled by default and accessible over the network, websites using these plugins are often exposed to the public internet. If your server is reachable from the web, it is considered to have a likely exposure to this threat.

What should I do if I run these plugins?

Your first step is to identify all WordPress instances running the Realtyna Organic IDX or WPL Real Estate plugins. Once identified, verify which sites are accessible from the internet, as these are the highest priority for protection. Coordinate with your team to review the plugin status and plan for an update to version 5.3.0 or later, which addresses the underlying file validation and credential issues.

References

wpscan.com/vulnerability/69f9dcd8-ab3c-46ed-ac6b-2f1db35f8d1f/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.