{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/wpl-real-estate-plugin--5.2.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-14483"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Organic IDX plugin (\u003c= 5.2.0)","WPL Real Estate plugin (\u003c= 5.2.0)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","rce","file-upload","cve-2026-14483"],"_cs_type":"advisory","_cs_vendors":["Realtyna"],"content_html":"\u003cp\u003eThe Realtyna Organic IDX and WPL Real Estate plugins for WordPress (versions 5.2.0 and below) contain a critical security vulnerability, tracked as CVE-2026-14483, which allows for unauthenticated remote code execution (RCE). The vulnerability stems from an insecure implementation of the plugin's I/O service endpoint. This endpoint is exposed to the public WordPress init hook without requiring standard WordPress user capability checks.\u003c/p\u003e\n\u003cp\u003eAuthentication for this endpoint relies on static API credentials (api_key and api_secret) that are hardcoded into the plugin's SQL migration files and are identical across every installation. Because these credentials are publicly known, an unauthenticated attacker can successfully authenticate to the I/O service. Once authenticated, the attacker can leverage an insufficiently validated file upload function to drop arbitrary files - including web shells - onto the server. Given the nature of WordPress environments, this permits the attacker to achieve full remote code execution on the underlying host, posing a severe risk to site integrity and data confidentiality.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify WordPress sites running vulnerable versions of the Organic IDX or WPL Real Estate plugins.\u003c/li\u003e\n\u003cli\u003eAttacker probes the web application for the publicly known Realtyna I/O service endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP POST request to the I/O endpoint, embedding the default static api_key and api_secret in the request parameters.\u003c/li\u003e\n\u003cli\u003eThe plugin's authentication logic validates the hardcoded credentials and grants the attacker an authorized session context.\u003c/li\u003e\n\u003cli\u003eAttacker executes a file upload action via the authorized endpoint, bypassing file type validation controls.\u003c/li\u003e\n\u003cli\u003eAttacker writes a malicious executable script (e.g., a PHP web shell) into a publicly accessible directory on the WordPress web server.\u003c/li\u003e\n\u003cli\u003eAttacker sends a secondary HTTP request to the uploaded file to trigger execution.\u003c/li\u003e\n\u003cli\u003eAttacker gains persistent remote code execution on the WordPress server for further exploitation or exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to take full control of the affected WordPress instance. This includes the ability to modify or delete site content, intercept user data, access the underlying database, and pivot into the internal network environment. This vulnerability affects all installations of the Organic IDX and WPL Real Estate plugins using version 5.2.0 or earlier.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Organic IDX and WPL Real Estate plugins to the latest version immediately to patch CVE-2026-14483.\u003c/li\u003e\n\u003cli\u003eImplement the provided Sigma rule to detect suspicious POST requests targeting the I/O service endpoint with known default credential parameters.\u003c/li\u003e\n\u003cli\u003eAudit the web server filesystem for unauthorized PHP or executable files uploaded within the last 30 days, specifically targeting plugin-related upload directories.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, restrict access to the I/O endpoint via Web Application Firewall (WAF) rules that block requests containing the known static API keys.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-31T07:36:11Z","date_published":"2026-07-31T07:36:11Z","id":"https://feed.craftedsignal.io/briefs/2026-07-realtyna-rce/","summary":"The Realtyna Organic IDX and WPL Real Estate plugins contain an arbitrary file upload vulnerability (CVE-2026-14483) allowing unauthenticated remote code execution via static, default API credentials.","title":"Unauthenticated Remote Code Execution in Realtyna Organic IDX and WPL Real Estate WordPress Plugins","url":"https://feed.craftedsignal.io/briefs/2026-07-realtyna-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - WPL Real Estate Plugin (\u003c= 5.2.0)","version":"https://jsonfeed.org/version/1.1"}