Critical Code Injection Vulnerability in Realtyna Organic IDX Plugin Disclosed

A critical vulnerability, CVE-2026-57811, has been identified in the Realtyna Organic IDX plugin for WordPress, affecting all versions up to 5.2.0. This flaw allows unauthenticated remote attackers to execute arbitrary code via code injection, leading to potential full system compromise. The vulnerability has a CVSS score of 10.0, indicating critical severity with complete impact on confidentiality, integrity, and availability. Currently, there are no known exploits in the wild, nor has any vendor advisory or patch been released. Users are advised to disable or remove the plugin until a fix is available. The vulnerability was published on 2026-07-13, and no public proof-of-concept has been reported yet. Security professionals should monitor for updates and apply mitigations as they become available.

Key Points: • CVE-2026-57811 is a critical code injection vulnerability in Realtyna Organic IDX plugin. • The vulnerability allows unauthenticated remote code execution, affecting versions up to 5.2.0. • No patches or vendor advisories are currently available; users should consider disabling the plugin.