Realtyna WPL lets Subscribers upload executable files
Realtyna Organic IDX plugin + WPL Real Estate through 5.3.0 combines three authorization and validation failures: saveLiveImages() does not validate file extensions or content, the get_keys() AJAX handler does not adequately restrict callers, and the REST API import endpoint lacks authentication. A Subscriber-or-higher attacker can obtain the required keys, submit attacker-controlled image data through the import path, and have saveLiveImages() write an arbitrary file to the server. If the uploaded file is executable by the web server, this enables remote code execution. The published.
- Component
- Realtyna Organic IDX plugin + WPL Real Estate
- Plugin slug
real-estate-listing-realtyna-wpl- Affected
- <= 5.3.0
- Safe version
5.4.0- Published
- Jul 31, 2026
This CVE was published Jul 31, 2026 and is one of 10 known issues for this plugin.
Update, patch or deactivate.
The official author release notes confirm remediation by 5.4.0; this does not establish that every intervening release was affected. Update the affected edition to 5.4.0 or a later maintained release on its supported branch. Application-level remediation requires authorization checks on the AJAX and REST paths and validation of uploaded file content and extensions. Until that is possible, restrict accounts to trusted users and deactivate the affected import functionality or plugin when warranted. Inspect upload and plugin-managed image directories for unexpected executable files and investigate Subscriber-level accounts that accessed the affected handlers. Official author release notes: https://wordpress.org/plugins/real-estate-listing-realtyna-wpl/.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to missing file extension and content validation in the saveLiveImages() function combined with an insufficient authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H