A critical code injection vulnerability in the Realtyna Organic IDX plugin allows unauthenticated attackers to execute arbitrary code on the host server.

This vulnerability, classified as CWE-94, involves improper control over code generation, enabling remote code inclusion. The attack vector is network-based and requires no authentication or user interaction.

Successful exploitation of this vulnerability grants an attacker complete control over the affected WordPress site and potentially the underlying web server. With a CVSS score of 10.0, this represents the highest level of risk, leading to total data compromise, site defacement, and potential pivot points into the broader network infrastructure.

Immediate Action: Identify if your environment is running version 5.2.0 or earlier of the Realtyna Organic IDX plugin and disable the plugin immediately until a patched version is applied.

Proactive Monitoring: Monitor server access logs for suspicious file inclusion patterns or unexpected outbound connections originating from the web server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common code injection payloads and suspicious HTTP requests targeting plugin-specific directories.

Public Exploit Available: Unknown.

Given the critical nature of this vulnerability and the potential for full system compromise, administrators must prioritize the removal or update of the affected plugin. Verify site integrity post-remediation to ensure no persistence mechanisms were established by unauthorized parties.