CVE-2026-13714: Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13714?
CVE-2026-13714 has a risk score of 95, indicating a critical vulnerability.
What type of vulnerability is CVE-2026-13714?
CVE-2026-13714 is an unauthenticated arbitrary file upload vulnerability that can lead to remote code execution.
How do I fix CVE-2026-13714?
To fix CVE-2026-13714, update the Realtyna Organic IDX plugin + WPL Real Estate to version 5.3.0 or later.
What might be the impact of CVE-2026-13714 on my website?
Exploitation of CVE-2026-13714 can allow attackers to upload malicious files, potentially leading to full server compromise.
Who is affected by CVE-2026-13714?
Users of the Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin versions prior to 5.3.0 are affected by CVE-2026-13714.