Back exploit-intel.com

CVE-2026-57811: WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerability [CRITICAL] Exploit Intelligence — CVEs with Exploits / 10h AI-analyzed exploit summary This exploit demonstrates unauthenticated arbitrary file upload leading to remote code execution (RCE) in Realtyna Organic IDX WordPress plugin (versions <= 5.2.0) by abusing a deprecated mobile application API endpoint with insufficient validation of the `commands_directory` parameter and file

exploit-intel.com • July 14, 2026

AI-analyzed exploit summary This exploit demonstrates unauthenticated arbitrary file upload leading to remote code execution (RCE) in Realtyna Organic IDX WordPress plugin (versions <= 5.2.0) by abusing a deprecated mobile application API endpoint with insufficient validation of the `commands_directory` parameter and file upload handling.

Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Remote Code Inclusion.This issue affects Realtyna Organic IDX plugin: from n/a through <= 5.2.0.

This exploit demonstrates unauthenticated arbitrary file upload leading to remote code execution (RCE) in Realtyna Organic IDX WordPress plugin (versions <= 5.2.0) by abusing a deprecated mobile application API endpoint with insufficient validation of the `commands_directory` parameter and file upload handling.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Code Injection Vulnerability in Realtyna Organic IDX Plugin Disclosed A critical vulnerability, CVE-2026-57811, has been identified in the Realtyna Organic IDX plugin for WordPress, affecting all versions up to 5.2.0. This flaw allows unauthenticated remote attackers to execute arbitrary code via code injection, leading to potential full system compromise. The vulnerability has a CVSS score of 10.0, indicating critical severity with complete impact on confidentiality, integrity, and availability. Currently, there are no known exploits in the wild, nor has any vendor advisory or patch been released. Users are advised to disable or remove the plugin until a fix is available. The vulnerability was published on 2026-07-13, and no public proof-of-concept has been reported yet. Security professionals should monitor for updates and apply mitigations as they become available. 2 sources 75

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)