A critical CSRF vulnerability in the Realtyna Organic IDX plugin for WordPress permits unauthenticated attackers to achieve Local File Inclusion, posing a severe risk of system compromise.

This vulnerability is a Cross-Site Request Forgery (CWE-352) that allows an unauthenticated attacker to trigger Local File Inclusion (LFI) via the real-estate-listing-realtyna-wpl component. By tricking an authenticated user into performing an action, an attacker can manipulate file paths to include unintended files.

The ability to perform Local File Inclusion allows an attacker to read sensitive configuration files or execute arbitrary code on the underlying server. Given the CVSS score of 7.5, this high-severity flaw threatens the confidentiality, integrity, and availability of the entire WordPress installation. Successful exploitation could lead to full site takeover and significant data exfiltration.

Immediate Action: Since a patch is currently unknown, administrators should immediately deactivate and uninstall the Realtyna Organic IDX plugin until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal patterns or unusual file inclusions targeting the WPL plugin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block CSRF attempts and common LFI payloads targeting WordPress plugin endpoints.

Public Exploit Available: Unknown.

The risk posed by this vulnerability is significant, as it effectively bridges the gap between a CSRF attack and server-side file manipulation. Organizations currently utilizing the Realtyna Organic IDX plugin must prioritize its removal to prevent potential exploitation. Continue to monitor the vendor advisory for release notifications regarding a permanent security patch.