VulnSocial

CVE-2026-16236Patch

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to missing file extension and content validation in the saveLiveImages() function combined with an insufficient authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-08-02: 1Patch / Workaround · 2026-08-02: 1Technical Details · 2026-08-02: 108-02
Signal classification1 categories
Patch
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-16236 - Critical RCE in Realtyna Organic IDX WP plugin. Arbitrary file upload from subscriber-level. CVSS 8.8. No patch. Disable plugin now. #CVE #WordPress #infosec #cvealert #devsecops #devops #sysadmin #github #gitlab #git #cvealert #redteam #blueteam #ethicalhacking #ethicalhacker #linux #developers #developer #100daysofcode #100daysofcybersecurity #cybersecurityawareness #cybersecuritytips #cybersecuritynews https://www.valtersit.com/cve/CVE-2026-16236

    Post summary

    CVE-2026-16236 is a critical remote code execution flaw in the Realtyna Organic IDX WordPress plugin, allowing arbitrary file uploads via subscriber privileges (CVSS 8.8). No patch exists yet, so users are advised to disable the plugin as a temporary workaround.

    0000076
    980 followersView on X

Explore more

Back to dashboard