The Realtyna Organic IDX plugin for WordPress is vulnerable to arbitrary file upload because the saveLiveImages() function lacks file extension and content validation, the get_keys AJAX handler performs insufficient authorization checks, and the REST API import endpoint lacks authentication. This flaw allows authenticated users with subscriber-level access or higher to upload any file to the server. If an attacker uploads a malicious script, remote code execution may be achieved.

The vulnerability affects the Realtyna Organic IDX plugin and the associated WPL Real Estate plugin running WordPress. All installations of these plugins up to and including version 5.3.0 are impacted. Users on earlier versions should upgrade or replace the plugin.

With a CVSS score of 8.8, the flaw presents high severity. The EPSS score is <1%, indicating a very low but non‑zero likelihood of exploitation. Because only subscriber‑level authentication is required, an attacker who can log in to the site could potentially exploit the vulnerability. The flaw is not listed in the CISA KEV catalog, indicating no known public exploitation yet. The attack path involves a legitimate user logging in, accessing the plugin’s AJAX interface or REST endpoint, and sending a crafted file upload request that bypasses content checks and writes the file to the server.