An unauthenticated remote code execution vulnerability in the Realtyna Organic IDX plugin + WPL Real Estate allows attackers to upload malicious files due to improper validation and hardcoded credentials.

The plugin fails to validate file types during upload, and the associated API is protected only by default, hardcoded credentials. This allows unauthenticated remote attackers to bypass security controls and execute arbitrary PHP code on the server.

Successful exploitation grants an attacker full control over the affected WordPress instance, leading to total compromise of site data, potential lateral movement within the hosting environment, and severe reputational damage. The CVSS score of 9.8 underscores the critical nature of this flaw, as it requires no prior authentication or user interaction.

Immediate Action: Update the Realtyna Organic IDX plugin + WPL Real Estate to version 5.3.0 or later immediately.

Proactive Monitoring: Audit the WordPress installation for any unauthorized files in the uploads directory and monitor server access logs for suspicious POST requests to the plugin API.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file upload attempts containing PHP extensions or to restrict access to the specific API endpoints managed by the plugin.

Public Exploit Available: Unknown

Immediate patching is required to eliminate the risk of total system compromise. If an update cannot be applied immediately, administrators should consider deactivating the plugin until a secure version is installed.