Is CVE-2026-16236 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16236 being exploited in the wild.

How severe is CVE-2026-16236?

High severity, with a CVSS score of 8.8, published 31 July 2026.

Which products and versions are affected?

Realtyna Organic IDX plugin + WPL Real Estate up to, and including, 5.3.0.

Is there a fix for CVE-2026-16236?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16236 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16236?

Check whether you run Realtyna Organic IDX plugin + WPL Real Estate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16236: Realtyna Organic IDX arbitrary file upload in saveLiveImages

CVE-2026-16236 · Severity: high · CVSS 8.8 · Published 2026-07-31

The Realtyna Organic IDX plugin for WordPress, which is used to integrate real estate listings into websites, contains a security flaw that allows users with basic account access to upload malicious files. An attacker could use this to take full control of the website's server, potentially leading to data theft or a complete site shutdown. This affects all versions of the plugin up to and including 5.3.0.

Vendors: Realtyna.

Quick answers

Is CVE-2026-16236 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16236 being exploited in the wild.
How severe is CVE-2026-16236?: High severity, with a CVSS score of 8.8, published 31 July 2026.
Which products and versions are affected?: Realtyna Organic IDX plugin + WPL Real Estate up to, and including, 5.3.0.
Is there a fix for CVE-2026-16236?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16236 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16236?: Check whether you run Realtyna Organic IDX plugin + WPL Real Estate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Realtyna Organic IDX plugin for WordPress is vulnerable to unrestricted file uploads due to missing file extension and content validation in the saveLiveImages() function. This is exacerbated by an insufficient authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. Authenticated attackers with subscriber-level permissions or higher can exploit these weaknesses to upload arbitrary files, such as PHP scripts, to the server. Successful exploitation can lead to remote code execution (RCE) and full system compromise. The vulnerability exists in all versions up to and including 5.3.0.

Affected products

Realtyna Organic IDX plugin + WPL Real Estate up to, and including, 5.3.0

Timeline

2026-07-31: disclosed
2026-07-31: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.