Critical Unauthenticated RCE in Realtyna WPL Real Estate Plugin

CVE-2026-13714 is a critical vulnerability (CVSS 9.8) affecting Realtyna's Organic IDX and WPL Real Estate plugins for WordPress versions prior to 5.3.0. The vulnerability resides in the plugin's I/O API, which fails to perform server-side file type validation. This flaw allows unauthenticated attackers to upload arbitrary files, including PHP shells, to the server. Publicly available exploit code demonstrates that attackers can leverage default API keys to bypass authentication and execute code. The exploit supports automated fingerprinting of WordPress installations, brute-force identification of the upload path, and multipart form-data requests to upload malicious files. Defenders should prioritize patching and monitoring for unauthorized file uploads in the plugin's upload directory.

Attack Chain

1. Attacker sends a probe request to ?get_realtyna_platform=1 to fingerprint the target and confirm the presence of the vulnerable WPL Real Estate plugin.
2. Attacker uses default, hardcoded I/O API keys to authenticate against the plugin's endpoint.
3. Attacker constructs a multipart/form-data POST request targeting the set_property command.
4. Attacker embeds a PHP web shell (e.g., image_Nx_abc.php) within the file[] parameter.
5. The plugin saves the file to the wp-content/uploads/WPL/{pid}/ directory without validating the file extension or content.
6. Attacker brute-forces the PID (Property ID) directory structure to locate the exact path of the uploaded file.
7. Attacker sends a GET request to the discovered file path in wp-content/uploads/WPL/{pid}/Nx_* to trigger PHP execution.
8. Attacker gains persistent remote code execution on the WordPress host.

Impact

Successful exploitation results in full site compromise, allowing attackers to exfiltrate sensitive database information, modify site content, or use the server for further lateral movement within the hosting environment. Given the widespread use of the WPL Real Estate plugin for property management, the risk of data exposure for real estate firms and their clients is significant.

Recommendation

• Update WPL Real Estate and Organic IDX plugins to version 5.3.0 or later immediately.
• Deploy the Sigma rule below to detect web requests attempting to access or write to the vulnerable plugin's upload directory.
• Rotate the I/O API keys in the wpl_settings table to invalidate currently known default keys.
• Implement a rewrite rule or server configuration to block direct access to wp-content/uploads/WPL/ files ending in .php.
• Disable the I/O API via plugin settings if it is not required for daily business operations.