CVE-2026-14483 json
Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command
published 3mo ago modified 2mo ago also EUVD-2026-51404
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.0%
- EPSS 4.0% chance of exploitation in 30 days, percentile 90%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint authenticated solely by static, plugin-seeded API credentials that are identical across all installations. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The WPL I/O service endpoint is registered on the public WordPress init hook with no WordPress capability check, and the required api_key and api_secret values are static defaults seeded by the plugin's own SQL migration files, meaning any unauthenticated attacker who knows these publicly documented defaults can reach and exploit the vulnerable upload path.
Is CVE-2026-14483 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 3mo ago
Exploit prediction
3.97% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Nuclei template Realtyna Organic IDX/WPL <= 5.2.0 - Unauthenticated Arbitrary File Upload nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- realtyna Realtyna Organic IDX plugin + WPL Real Estate
Classification
- Weakness
-
- CWE-434 Unrestricted Upload of File with Dangerous Type
- Technology feeds
References
- wordfence.com /threat-intel/vulnerabilities/id/23068a98-623d-4eb3-a7c5-6af410de4320?source=cve
- plugins.trac.wordpress.org /browser/real-estate-listing-realtyna-wpl/trunk/libraries/file.php#L217
- plugins.trac.wordpress.org /browser/real-estate-listing-realtyna-wpl/trunk/libraries/io/mobile_application/set_property.php#L39
- plugins.trac.wordpress.org /browser/real-estate-listing-realtyna-wpl/trunk/libraries/services/io.php#L20
- plugins.trac.wordpress.org /browser/real-estate-listing-realtyna-wpl/trunk/libraries/io/global.php#L142
- plugins.trac.wordpress.org /browser/real-estate-listing-realtyna-wpl/trunk/assets/migrations/basic/1.0.0.sql#L1119
Sources
- CVE List CVE-2026-14483
- NVD CVE-2026-14483
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.