A critical arbitrary file upload vulnerability in the Realtyna Organic IDX plugin allows unauthenticated attackers to achieve remote code execution.

The plugin suffers from an unrestricted file upload vulnerability (CWE-434) caused by a lack of file type validation and the use of static, publicly documented API credentials. This permits an unauthenticated attacker to upload executable files, leading to remote code execution.

The CVSS score of 9.8 reflects the ease of exploitation and the severity of the potential outcome. An attacker can gain control over the WordPress site, leading to site defacement, data theft, or complete compromise of the underlying server. This poses a significant threat to the operational integrity and reputation of any business relying on this plugin.

Immediate Action: As there is currently no patched version available, administrators should immediately deactivate and remove the Realtyna Organic IDX plugin and WPL Real Estate plugin from their WordPress environments. Do not re-enable the plugin until a security update is released by the vendor.

Proactive Monitoring: Review web server logs for suspicious requests to plugin-specific directories or I/O endpoints. Scan the file system for unauthorized script files that may have been uploaded via this vector.

Compensating Controls: Use a Web Application Firewall to block access to the vulnerable I/O service endpoints. Implement strict file system permissions to prevent the execution of scripts in any upload-accessible folders.

Public Exploit Available: No (unknown)

Due to the critical risk and the absence of a patch, deactivation of the affected plugin is the only secure course of action. Organizations must prioritize removing this software to prevent potential remote code execution attacks. Continue to monitor vendor communications for the release of a secure version.