The Realtyna Organic IDX + WPL Real Estate plugin for WordPress (versions up to and including 5.2.0) is vulnerable to arbitrary file upload leading to remote code execution. The vulnerability stems from missing file type validation in the upload function and a publicly accessible I/O endpoint that uses static, hardcoded API credentials identical across all installations. The WPL I/O service endpoint is registered on the public WordPress init hook with no capability checks, making it accessible to unauthenticated attackers. The required api_key and api_secret values are static defaults seeded by the plugin's own SQL migration files and are publicly documented. Any unauthenticated attacker with knowledge of these default credentials can upload executable files and achieve remote code execution on affected WordPress installations. The combination of missing authentication controls and lack of file type validation makes this a critical, easily exploitable vulnerability.