Vulnerabilities CVE-2026-13714

CVE-2026-13714

None

Open

TLP:CLEAR

Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.

Details

EPSS Score ⓘ: 0.46%

38.2th percentile
Confidence: 90%
Published: Jul 27, 2026
Last Modified: Jul 27, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.