CVE-2026-14483Disclosure

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint authenticated solely by static, plugin-seeded API credentials that are identical across all installations. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The WPL I/O service endpoint is registered on the public WordPress init hook with no WordPress capability check, and the required api_key and api_secret values are static defaults seeded by the plugin's own SQL migration files, meaning any unauthenticated attacker who knows these publicly documented defaults can reach and exploit the vulnerable upload path.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-434

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
3 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 2d ago at 1 mentions (2026-07-31); latest day: 1
3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d

Signal classification2 categories

Disclosure

266.7%

General

133.3%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-31	1	Disclosure1
2026-08-14	1	Disclosure1
2026-09-11	1	General1

Full discourse3 posts

pdnuclei-bot@pdnuclei_bot78d
Disclosure
🚨 CVE-2026-14483 - critical 🚨 Realtyna Organic IDX/WPL <= 5.2.0 - Unauthenticated Arbitrary File Upload > Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress <= 5.2.0 contains ... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-14483 @pdnuclei #NucleiTe...
Post summary
The tweet announces CVE-2026-14483, detailing an unauthenticated arbitrary file upload flaw in Realtyna Organic IDX plugin v5.2.0 or earlier, and provides a link for further information.
00001227
1.2K followersView on X
IntegSec@integ_sec49d
General
CVE-2026-14483: Realtyna Organic IDX and WPL Real Estate Arbitrary File Upload - What It Means for Your Business and How to Respond https://hubs.li/Q04xhbcG0
Post summary
The article announces CVE‑2026‑14483, an arbitrary file upload vulnerability in Realtyna Organic IDX and WPL Real Estate, and provides general guidance for businesses on how to respond.
0000039
35 followersView on X
Upwind Security MDR@UpwindMDR91d
Disclosure
🚨Critical - Realtyna Organic IDX/WPL WP Plugin Unauth File Upload to RCE (CVE-2026-14483) Realtyna Organic IDX + WPL Real Estate exposes a public I/O endpoint on the WordPress init hook that accepts default static API credentials seeded by the plugin. Missing file type validation in the upload function lets unauth attackers upload executable files (e.g., PHP) to web-accessible paths, leading to RCE. 👉Affected: Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0
Post summary
A new critical CVE-2026-14483 in Realtyna Organic IDX/WPL Real Estate allows unauthenticated PHP uploads leading to RCE; the post details the flaw but does not include a PoC, exploit code, or evidence of active exploitation.
00000125
275 followersView on X

Explore more

Back to dashboard