Executive brief
The Realtyna WPL Real Estate plugin for WordPress, which is used to manage property listings, contains a critical security flaw that allows unauthorized users to upload files to the web server. Because the plugin uses default, publicly known credentials for its internal communication, an attacker can bypass security checks and upload malicious scripts. This could allow an attacker to take full control of the website, steal sensitive data, or disrupt business operations.
Technical details
The vulnerability exists in the WPL I/O service endpoint due to a combination of missing file type validation and the use of hardcoded, static API credentials. The endpoint is registered on the WordPress 'init' hook without capability checks, making it publicly accessible. Authentication relies on 'api_key' and 'api_secret' values that are seeded via static SQL migration files and are identical across all installations. An unauthenticated attacker can use these known credentials to access the upload function and upload executable PHP files, resulting in remote code execution (RCE). All versions up to and including 5.2.0 are affected.
Affected products
- Realtyna WPL Real Estate (Organic IDX) plugin up to, and including, 5.2.0
Timeline
- 2026-07-31: disclosed
- 2026-07-31: advisory
References
- https://plugins.trac.wordpress.org/browser/real-estate-listing-realtyna-wpl/trunk/assets/migrations/basic/1.0.0.sql
- https://plugins.trac.wordpress.org/browser/real-estate-listing-realtyna-wpl/trunk/libraries/file.php
- https://plugins.trac.wordpress.org/browser/real-estate-listing-realtyna-wpl/trunk/libraries/io/global.php
- https://plugins.trac.wordpress.org/browser/real-estate-listing-realtyna-wpl/trunk/libraries/io/mobile_application/set_property.php
- https://plugins.trac.wordpress.org/browser/real-estate-listing-realtyna-wpl/trunk/libraries/services/io.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/23068a98-623d-4eb3-a7c5-6af410de4320?source=cve