The Realtyna Organic IDX plugin + WPL Real Estate, versions before 5.3.0, fails to validate the file type of uploaded content. The plugin exposes a file upload function that is gated only by an API endpoint that uses hard‑coded credentials supplied identically in every installation. This flaw lets attackers upload arbitrary PHP files, giving them execution privileges on the host server. The weakness is classified as CWE‑434, a lack of input validation for file types, which allows an attacker to compromise application integrity and confidentiality by uploading and running malicious code.

All installations of the Realtyna Organic IDX plugin + WPL Real Estate that use a version earlier than 5.3.0 are vulnerable. The vulnerability exists in the plugin itself regardless of the WordPress site version, as the hard‑coded credentials are bundled with every release prior to the patch.

The vulnerability carries a CVSS score of 9.8, indicating a high likelihood of exploitation once discovered. Its EPSS score is 0.462%, suggesting that, while the likelihood of finding a vulnerability is low, exploitation campaigns could still occur. The issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated POST to the API endpoint used for file uploads; because the credentials are the same across all installations, an attacker need not guess a password. If the API is exposed publicly, an attacker can simply upload a PHP backdoor and trigger it by accessing the URL of the uploaded file, achieving remote code execution.