Realtyna - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/realtyna/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 31 Jul 2026 07:36:25 +0000Arbitrary File Upload Vulnerability in Realtyna Organic IDX Pluginhttps://feed.craftedsignal.io/briefs/2026-07-realtyna-idx-upload/Fri, 31 Jul 2026 07:36:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-realtyna-idx-upload/The Realtyna Organic IDX plugin for WordPress contains an arbitrary file upload vulnerability (CVE-2026-16236) due to improper validation and authentication, allowing remote attackers to achieve remote code execution.The Realtyna Organic IDX plugin for WordPress, in versions up to and including 5.3.0, is susceptible to an arbitrary file upload vulnerability. This vulnerability originates from the saveLiveImages() function, which fails to implement necessary file extension and content validation. Additionally, the plugin exhibits insufficient authorization checks within the get_keys() AJAX handler and a complete lack of authentication checks on the REST API import endpoint.

These security flaws permit an authenticated attacker, holding at least subscriber-level privileges, to upload malicious files to the server. By bypassing these checks, an attacker can upload web shells or other malicious scripts, which can then be executed to gain remote code execution (RCE) on the underlying WordPress server. This poses a significant risk to the integrity and confidentiality of the host environment, as it effectively provides a pathway for unauthorized code execution within the web context.

Attack Chain

  1. Attacker registers or gains access to a subscriber-level account on a WordPress site utilizing Organic IDX <= 5.3.0.
  2. Attacker targets the insecure REST API import endpoint or the get_keys() AJAX handler to initiate an interaction.
  3. Attacker crafts a malicious payload, such as a PHP web shell, encapsulated within a file upload request.
  4. Attacker sends an HTTP POST request to the vulnerable endpoint, bypassing the insufficient authentication controls.
  5. The saveLiveImages() function fails to validate the file extension or content, allowing the server to save the malicious file to the web root.
  6. Attacker navigates to the uploaded file path via a browser or script to trigger the execution of the embedded code.
  7. The server executes the malicious script under the context of the web server user.
  8. Attacker gains persistence or performs further post-exploitation activities such as data exfiltration.

Impact

Successful exploitation of this vulnerability allows an authenticated attacker to upload arbitrary files, leading to potential remote code execution. This can result in a full site compromise, sensitive data theft, and the ability to pivot into the underlying server network. All WordPress sites running the Organic IDX plugin version 5.3.0 or earlier are currently at risk.

Recommendation

  • Immediately update the Realtyna Organic IDX plugin to the latest version that patches CVE-2026-16236.
  • Disable the Realtyna Organic IDX plugin until a security update is applied if patching cannot be performed immediately.
  • Audit web server logs for suspicious POST requests targeting /wp-json/ or specific AJAX handler endpoints that result in file creation in public directories.
  • Restrict access to the WordPress dashboard and administrative REST API endpoints to known, trusted IP addresses to prevent unauthorized access by potential attackers.
]]>highadvisoryUnauthenticated Remote Code Execution in Realtyna Organic IDX and WPL Real Estate WordPress Pluginshttps://feed.craftedsignal.io/briefs/2026-07-realtyna-rce/Fri, 31 Jul 2026 07:36:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-realtyna-rce/The Realtyna Organic IDX and WPL Real Estate plugins contain an arbitrary file upload vulnerability (CVE-2026-14483) allowing unauthenticated remote code execution via static, default API credentials.The Realtyna Organic IDX and WPL Real Estate plugins for WordPress (versions 5.2.0 and below) contain a critical security vulnerability, tracked as CVE-2026-14483, which allows for unauthenticated remote code execution (RCE). The vulnerability stems from an insecure implementation of the plugin's I/O service endpoint. This endpoint is exposed to the public WordPress init hook without requiring standard WordPress user capability checks.

Authentication for this endpoint relies on static API credentials (api_key and api_secret) that are hardcoded into the plugin's SQL migration files and are identical across every installation. Because these credentials are publicly known, an unauthenticated attacker can successfully authenticate to the I/O service. Once authenticated, the attacker can leverage an insufficiently validated file upload function to drop arbitrary files - including web shells - onto the server. Given the nature of WordPress environments, this permits the attacker to achieve full remote code execution on the underlying host, posing a severe risk to site integrity and data confidentiality.

Attack Chain

  1. Attacker performs reconnaissance to identify WordPress sites running vulnerable versions of the Organic IDX or WPL Real Estate plugins.
  2. Attacker probes the web application for the publicly known Realtyna I/O service endpoint.
  3. Attacker crafts an HTTP POST request to the I/O endpoint, embedding the default static api_key and api_secret in the request parameters.
  4. The plugin's authentication logic validates the hardcoded credentials and grants the attacker an authorized session context.
  5. Attacker executes a file upload action via the authorized endpoint, bypassing file type validation controls.
  6. Attacker writes a malicious executable script (e.g., a PHP web shell) into a publicly accessible directory on the WordPress web server.
  7. Attacker sends a secondary HTTP request to the uploaded file to trigger execution.
  8. Attacker gains persistent remote code execution on the WordPress server for further exploitation or exfiltration.

Impact

Successful exploitation allows an unauthenticated attacker to take full control of the affected WordPress instance. This includes the ability to modify or delete site content, intercept user data, access the underlying database, and pivot into the internal network environment. This vulnerability affects all installations of the Organic IDX and WPL Real Estate plugins using version 5.2.0 or earlier.

Recommendation

  • Update the Organic IDX and WPL Real Estate plugins to the latest version immediately to patch CVE-2026-14483.
  • Implement the provided Sigma rule to detect suspicious POST requests targeting the I/O service endpoint with known default credential parameters.
  • Audit the web server filesystem for unauthorized PHP or executable files uploaded within the last 30 days, specifically targeting plugin-related upload directories.
  • If immediate patching is not possible, restrict access to the I/O endpoint via Web Application Firewall (WAF) rules that block requests containing the known static API keys.
]]>criticaladvisorywordpressrcefile-uploadcve-2026-14483