The plugin exposes an upload routine that performs no file‑type validation. Combined with a publicly accessible I/O service that relies only on static API credentials seeded by the plugin’s default migration files, an attacker can authenticate without any knowledge of the site’s administrator credentials and upload files that the server may execute. This flaw is a classic Arbitrary File Upload, classified as CWE‑434, allowing complete compromise of the WordPress installation.

All installations of Realtyna Organic IDX plugin + WPL Real Estate with versions up to and including 5.2.0 are vulnerable. The flaw resides in the set_property endpoint registered on the WordPress init hook; no capability check is performed. Any user who can contact the endpoint with the static api_key and api_secret pair can trigger the upload path.

The CVSS score of 9.8 marks the vulnerability as critical. The EPSS score is 2%, indicating a very low but nonzero probability of exploitation. The absence of a KEV listing does not reduce the potential for exploitation; the required conditions—a public endpoint, known default credentials, and no file‑type filtering—are straightforward to meet. An unauthenticated attacker can directly POST a payload, resulting in remote code execution on the receiving WordPress server.