VulnSocial

CVE-2026-13714Disclosure

MEDIUMCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-434

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 5 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 2 signals
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 2d ago at 3 mentions (2026-07-27); latest day: 1
  • 5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d
01223Mentions · 2026-07-27: 3Mentions · 2026-08-01: 1Mentions · 2026-08-02: 1PoC Mentioned / Linked · 2026-07-27: 1PoC Mentioned / Linked · 2026-08-02: 1Exploit Tool / Code · 2026-08-02: 1Patch / Workaround · 2026-08-01: 1Technical Details · 2026-07-27: 2Technical Details · 2026-08-01: 1Technical Details · 2026-08-02: 107-2708-0108-02
Signal classification4 categories
Disclosure
240.0%
General
120.0%
Patch
120.0%
PoC
120.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-07-273
Disclosure2General1
2026-08-011
Patch1
2026-08-021
PoC1
Full discourse5 posts
  • Nxploited@Nxploited
    PoC

    CVE-2026-13714 | WPL Real Estate for WordPress ≤ 5.2.0 Unauthenticated RCE 9.8 CRITICAL PoC: https://github.com/Nxploited/CVE-2026-13714 #CVE202613714 #WordPress #RCE #0day #BugBounty #InfoSec #CyberSecurity #WPL #WebSecurity #PenTest #Exploit #RedTeam #OffSec #VulnerabilityDisclosure

    Post summary

    A critical unauthenticated remote code execution vulnerability (CVE-2026-13714) in WPL Real Estate for WordPress, with a PoC linked to a GitHub repository, but no evidence of active exploitation or patch discussion.

    00012221
    119 followersView on X
  • ExploitGrid@exploitgrid
    General

    #ExploitGrid Daily Threat Digest Top #Vulnerabilities (CVEs) of the day CVE-2026-16812 CVE-2026-12394 CVE-2026-13714 CVE-2026-63077 CVE-2026-66395 ..🧵👇

    Post summary

    The tweet merely lists a set of CVEs without providing details on exploitation, tools, patches, or technical specifics.

    1100057
    28 followersView on X
  • ExploitGrid@exploitgrid
    Disclosure

    [CVE] CVE-2026-13714 [HIGH PRIORITY] #Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbit... 🔗 https://exploitgrid.net/cve/CVE-2026-13714

    Post summary

    The post announces a high‑priority CVE (CVE‑2026‑13714) affecting Realtyna Organic IDX and WPL Real Estate plugins, linking to ExploitGrid for details, but it provides no exploit code, patch, or evidence of active exploitation.

    1000033
    28 followersView on X
  • SecAlerts@SecAlertsCo
    Patch

    🏠 Realtyna Organic IDX plugin + WPL Real Estate (WordPress) before 5.3.0: unauthenticated arbitrary file upload leads to RCE. CVSS 9.8. No auth required. CVE-2026-13714 — update to 5.3.0 now. #cybersecurity #ciso #wordpress #vulnerabilities https://secalerts.co/vulnerability/CVE-2026-13714?utm_campaign=x https://t.co/QZOfdzacW2

    Post summary

    The text announces a critical RCE vulnerability in the Realtyna Organic IDX plugin, highlights the need for an update to version 5.3.0, and provides a CVSS score and attack vector.

    00000121
    871 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-13714 Unauthenticated Remote Code Execution via Arbitrary File Upload in Realtyna Organic IDX Plugin https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-13714

    Post summary

    CVE-2026-13714 is a newly disclosed unauthenticated remote code execution vulnerability in Realtyna Organic IDX Plugin caused by arbitrary file upload, with no PoC, exploit, or remediation details provided.

    0000098
    4.1K followersView on X

Explore more

Back to dashboard