Realtyna WPL Real Estate <= 5.3.0 Authenticated Arbitrary File Upload (CVE-2026-16236)

Vulnerability Overview Vulnerability Name: Realtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Authenticated (Subscriber+) Arbitrary File Upload CVE ID: CVE-2026-16236 CVSS Score: 8.8 (High) Publication Date: July 30, 2026 Last Updated: July 31, 2026 Researcher: Son Yan (mrsix06) - FPT University Impact Scope Software Type: Plugin Software Name: real-estate-listing-realtyna-wpl Affected Versions: <= 5.3.0 Vulnerability Description: The Realtyna Organic IDX plugin for WordPress versions <= 5.3.0 contains an arbitrary file upload vulnerability. This issue stems from the lack of file extension and content validation, combined with the function and insufficient authorization checks, allowing unauthorized file uploads via the AJAX handler and REST API import endpoint. This enables authenticated attackers (at the Subscriber level and above) to upload arbitrary files to the server of the affected website, potentially leading to remote code execution. Remediation Patch Status: No known patch is available. Recommended Actions: Please review the vulnerability details in depth and implement mitigation measures based on your organization's risk tolerance. It may be necessary to uninstall the affected software and seek alternatives. Additional Information References: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Recent Vulnerability List Summary This vulnerability allows authenticated attackers to upload arbitrary files, which could lead to remote code execution. It is recommended to review this issue and take appropriate measures to mitigate the risk as soon as possible.

Goal Reached Thanks to every supporter — we hit 100%!

Realtyna WPL Real Estate <= 5.3.0 Authenticated Arbitrary File Upload (CVE-2026-16236)

More from this source