CVE-2026-125852: WordPress Realtyna Organic IDX plugin plugin <= 5.4.2 - Arbitrary File Deletion vulnerability

Q: What access does an attacker need to exploit this issue?

The vulnerability is remotely reachable and has low attack complexity, but requires low-level privileges. No user interaction is required.

Q: What is the likely impact if exploitation succeeds?

The reported impact is arbitrary file deletion through path traversal. The vulnerability is rated high with an availability impact of high, while confidentiality and integrity impacts are listed as none.

Q: Which plugin versions should be treated as affected?

The affected-product data states that Realtyna Organic IDX is affected from an unspecified starting version through 5.5.0. Although the title references version 5.4.2, the broader affected range in the description should be used for triage.

Published Nov 13, 2026

Updated

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Path Traversal.This issue affects Realtyna Organic IDX plugin: from n/a through 5.5.0.

Affected Software

1 affected component

wordpress/real-estate-listing-realtyna-wpl<=5.5.0

Event History

Nov 13, 2026

CVE Published

via MITRE·03:08 PM

Data Sourced

via MITRE·03:08 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The vulnerability is remotely reachable and has low attack complexity, but requires low-level privileges. No user interaction is required.

What is the likely impact if exploitation succeeds?

The reported impact is arbitrary file deletion through path traversal. The vulnerability is rated high with an availability impact of high, while confidentiality and integrity impacts are listed as none.

Which plugin versions should be treated as affected?

The affected-product data states that Realtyna Organic IDX is affected from an unspecified starting version through 5.5.0. Although the title references version 5.4.2, the broader affected range in the description should be used for triage.

CVE-2026-125852: WordPress Realtyna Organic IDX plugin plugin <= 5.4.2 - Arbitrary File Deletion vulnerability

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?

Which plugin versions should be treated as affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?

Which plugin versions should be treated as affected?