The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality …

CVE-2026-13714 affects the Realtyna Organic IDX plugin combined with WPL Real Estate WordPress plugin before version 5.3.0. The plugin fails to validate uploaded file types, allowing arbitrary PHP file uploads. The file upload API is enabled by default and uses hardcoded credentials that are identical across all installations. This effectively means any unauthenticated attacker can leverage the hardcoded credentials to access the API. Successful exploitation leads to remote code execution on the affected WordPress site. All installations prior to version 5.3.0 are vulnerable. The vulnerability is rated high severity due to its unauthenticated nature and direct RCE impact.