CVE-2026-14483: Realtyna WPL Real Estate Unauthenticated Arbitrary File Upload leading to RCE

Vulnerability Overview Vulnerability Name: Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command CVE ID: CVE-2026-14483 CVSS Score: 9.8 (Critical) Publication Date: July 30, 2026 Last Updated: August 4, 2026 Researcher: Khaled Alenzi (Exploited) Impact Scope Affected Versions: Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 Vulnerability Type: Unauthenticated Arbitrary File Upload Vulnerability Description: The plugin contains a vulnerability in versions 5.2.0 and earlier due to the lack of file type validation and a public I/O endpoint, allowing attackers to upload executable files and achieve Remote Code Execution (RCE). Remediation Patch Status: No patch available Recommended Actions: Consider uninstalling the affected software or seeking alternative solutions based on your organization's risk tolerance. Additional Information References: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Related Vulnerabilities Recent Vulnerability List: - CVE-2026-16236: Authenticated (Subscriber) Arbitrary File Upload - CVE-2026-57811: Unauthenticated Remote Code Execution - CVE-2026-13714: Unauthenticated Arbitrary File Upload - CVE-2026-45439: Unauthenticated SQL Injection - CVE-2025-54052: Unauthenticated Local File Inclusion - CVE-2024-38735: Authenticated (Admin) Arbitrary File Upload - CVE-2024-33924: Reflected Cross-Site Scripting - CVE-2024-32128: Unauthenticated SQL Injection Summary This vulnerability allows unauthenticated attackers to upload arbitrary files via a public I/O endpoint, potentially leading to Remote Code Execution. Users are advised to implement mitigation measures as soon as possible, such as uninstalling the affected plugin or finding alternative solutions.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-14483: Realtyna WPL Real Estate Unauthenticated Arbitrary File Upload leading to RCE

More from this source