{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/realtyna/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-16236"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Organic IDX (\u003c= 5.3.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Realtyna"],"content_html":"\u003cp\u003eThe Realtyna Organic IDX plugin for WordPress, in versions up to and including 5.3.0, is susceptible to an arbitrary file upload vulnerability. This vulnerability originates from the saveLiveImages() function, which fails to implement necessary file extension and content validation. Additionally, the plugin exhibits insufficient authorization checks within the get_keys() AJAX handler and a complete lack of authentication checks on the REST API import endpoint.\u003c/p\u003e\n\u003cp\u003eThese security flaws permit an authenticated attacker, holding at least subscriber-level privileges, to upload malicious files to the server. By bypassing these checks, an attacker can upload web shells or other malicious scripts, which can then be executed to gain remote code execution (RCE) on the underlying WordPress server. This poses a significant risk to the integrity and confidentiality of the host environment, as it effectively provides a pathway for unauthorized code execution within the web context.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker registers or gains access to a subscriber-level account on a WordPress site utilizing Organic IDX \u0026lt;= 5.3.0.\u003c/li\u003e\n\u003cli\u003eAttacker targets the insecure REST API import endpoint or the get_keys() AJAX handler to initiate an interaction.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious payload, such as a PHP web shell, encapsulated within a file upload request.\u003c/li\u003e\n\u003cli\u003eAttacker sends an HTTP POST request to the vulnerable endpoint, bypassing the insufficient authentication controls.\u003c/li\u003e\n\u003cli\u003eThe saveLiveImages() function fails to validate the file extension or content, allowing the server to save the malicious file to the web root.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the uploaded file path via a browser or script to trigger the execution of the embedded code.\u003c/li\u003e\n\u003cli\u003eThe server executes the malicious script under the context of the web server user.\u003c/li\u003e\n\u003cli\u003eAttacker gains persistence or performs further post-exploitation activities such as data exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an authenticated attacker to upload arbitrary files, leading to potential remote code execution. This can result in a full site compromise, sensitive data theft, and the ability to pivot into the underlying server network. All WordPress sites running the Organic IDX plugin version 5.3.0 or earlier are currently at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the Realtyna Organic IDX plugin to the latest version that patches CVE-2026-16236.\u003c/li\u003e\n\u003cli\u003eDisable the Realtyna Organic IDX plugin until a security update is applied if patching cannot be performed immediately.\u003c/li\u003e\n\u003cli\u003eAudit web server logs for suspicious POST requests targeting /wp-json/ or specific AJAX handler endpoints that result in file creation in public directories.\u003c/li\u003e\n\u003cli\u003eRestrict access to the WordPress dashboard and administrative REST API endpoints to known, trusted IP addresses to prevent unauthorized access by potential attackers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-31T07:36:25Z","date_published":"2026-07-31T07:36:25Z","id":"https://feed.craftedsignal.io/briefs/2026-07-realtyna-idx-upload/","summary":"The Realtyna Organic IDX plugin for WordPress contains an arbitrary file upload vulnerability (CVE-2026-16236) due to improper validation and authentication, allowing remote attackers to achieve remote code execution.","title":"Arbitrary File Upload Vulnerability in Realtyna Organic IDX Plugin","url":"https://feed.craftedsignal.io/briefs/2026-07-realtyna-idx-upload/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-14483"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Organic IDX plugin (\u003c= 5.2.0)","WPL Real Estate plugin (\u003c= 5.2.0)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","rce","file-upload","cve-2026-14483"],"_cs_type":"advisory","_cs_vendors":["Realtyna"],"content_html":"\u003cp\u003eThe Realtyna Organic IDX and WPL Real Estate plugins for WordPress (versions 5.2.0 and below) contain a critical security vulnerability, tracked as CVE-2026-14483, which allows for unauthenticated remote code execution (RCE). The vulnerability stems from an insecure implementation of the plugin's I/O service endpoint. This endpoint is exposed to the public WordPress init hook without requiring standard WordPress user capability checks.\u003c/p\u003e\n\u003cp\u003eAuthentication for this endpoint relies on static API credentials (api_key and api_secret) that are hardcoded into the plugin's SQL migration files and are identical across every installation. Because these credentials are publicly known, an unauthenticated attacker can successfully authenticate to the I/O service. Once authenticated, the attacker can leverage an insufficiently validated file upload function to drop arbitrary files - including web shells - onto the server. Given the nature of WordPress environments, this permits the attacker to achieve full remote code execution on the underlying host, posing a severe risk to site integrity and data confidentiality.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify WordPress sites running vulnerable versions of the Organic IDX or WPL Real Estate plugins.\u003c/li\u003e\n\u003cli\u003eAttacker probes the web application for the publicly known Realtyna I/O service endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP POST request to the I/O endpoint, embedding the default static api_key and api_secret in the request parameters.\u003c/li\u003e\n\u003cli\u003eThe plugin's authentication logic validates the hardcoded credentials and grants the attacker an authorized session context.\u003c/li\u003e\n\u003cli\u003eAttacker executes a file upload action via the authorized endpoint, bypassing file type validation controls.\u003c/li\u003e\n\u003cli\u003eAttacker writes a malicious executable script (e.g., a PHP web shell) into a publicly accessible directory on the WordPress web server.\u003c/li\u003e\n\u003cli\u003eAttacker sends a secondary HTTP request to the uploaded file to trigger execution.\u003c/li\u003e\n\u003cli\u003eAttacker gains persistent remote code execution on the WordPress server for further exploitation or exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to take full control of the affected WordPress instance. This includes the ability to modify or delete site content, intercept user data, access the underlying database, and pivot into the internal network environment. This vulnerability affects all installations of the Organic IDX and WPL Real Estate plugins using version 5.2.0 or earlier.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Organic IDX and WPL Real Estate plugins to the latest version immediately to patch CVE-2026-14483.\u003c/li\u003e\n\u003cli\u003eImplement the provided Sigma rule to detect suspicious POST requests targeting the I/O service endpoint with known default credential parameters.\u003c/li\u003e\n\u003cli\u003eAudit the web server filesystem for unauthorized PHP or executable files uploaded within the last 30 days, specifically targeting plugin-related upload directories.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, restrict access to the I/O endpoint via Web Application Firewall (WAF) rules that block requests containing the known static API keys.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-31T07:36:11Z","date_published":"2026-07-31T07:36:11Z","id":"https://feed.craftedsignal.io/briefs/2026-07-realtyna-rce/","summary":"The Realtyna Organic IDX and WPL Real Estate plugins contain an arbitrary file upload vulnerability (CVE-2026-14483) allowing unauthenticated remote code execution via static, default API credentials.","title":"Unauthenticated Remote Code Execution in Realtyna Organic IDX and WPL Real Estate WordPress Plugins","url":"https://feed.craftedsignal.io/briefs/2026-07-realtyna-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Realtyna","version":"https://jsonfeed.org/version/1.1"}