Critical severity9.8NVD Advisory· Published Jul 27, 2026· Updated Jul 27, 2026

CVE-2026-13714

Description

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Realtyna Organic IDX plugin + WPL Real Estatellm-fuzzy
Range: <5.3.0

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/69f9dcd8-ab3c-46ed-ac6b-2f1db35f8d1f/nvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000