CVE-2026-16236: Realtyna Organic IDX Plugin RCE Flaw

CVE-2026-16236 Overview

CVE-2026-16236 is an arbitrary file upload vulnerability in the Realtyna Organic IDX plugin for WordPress, affecting all versions up to and including 5.3.0. The flaw exists in the saveLiveImages() function, which lacks file extension and content validation. An insufficient authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint compound the issue. Authenticated attackers with subscriber-level access can upload arbitrary files to the affected site, which may enable remote code execution. The vulnerability is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated subscribers can upload arbitrary files to the web server, enabling remote code execution and full site compromise.

Affected Products

Realtyna Organic IDX plugin (real-estate-listing-realtyna-wpl) for WordPress
All versions up to and including 5.3.0
WordPress sites with subscriber-level or higher registration enabled

Discovery Timeline

2026-07-31 - CVE-2026-16236 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-16236

Vulnerability Analysis

The vulnerability chains three distinct weaknesses in the Realtyna Organic IDX plugin. The saveLiveImages() function in libraries/idx/idx_property_mapper.php accepts uploaded files without validating extension or MIME content. The get_keys() AJAX handler in views/backend/addon_idx/wpl_ajax.php performs an inadequate authorization check, permitting low-privilege users to reach sensitive functionality. The REST API import endpoint defined in api/init.php lacks any authentication requirement, exposing file-writing paths to authenticated attackers with minimal privileges. Together, these gaps allow attackers to place PHP or other executable content within the WordPress webroot.

Root Cause

The root cause is missing input validation and broken access control. The plugin relies on client-supplied filenames and does not enforce an allowlist of safe extensions. Authorization logic on get_keys() checks for the presence of a request parameter rather than a capability, and the REST route registration in api/init.php omits a permission_callback, defaulting to open access.

Attack Vector

An attacker authenticates as a subscriber, then invokes the vulnerable AJAX or REST endpoint to submit a crafted upload request containing a PHP payload. Because no extension check runs in saveLiveImages(), the file is written to a web-accessible directory. The attacker then requests the uploaded file via HTTP to trigger execution under the web server user context.

See the Wordfence Vulnerability Report and the vulnerable code paths in api/init.php, addon_idxn.php, idx_property_mapper.php, and wpl_ajax.php for technical details.

Detection Methods for CVE-2026-16236

Indicators of Compromise

Unexpected .php, .phtml, or .phar files within the wp-content/uploads/ directory tree or plugin upload paths
HTTP POST requests from low-privileged accounts to admin-ajax.php with action=get_keys or to REST routes registered by the Realtyna IDX plugin
New or modified files owned by the web server user in plugin-controlled directories following subscriber account activity
Outbound network connections initiated by the PHP-FPM or Apache worker process to unknown hosts

Detection Strategies

Monitor WordPress access logs for POST requests to /wp-admin/admin-ajax.php combined with the saveLiveImages or get_keys parameters from non-admin user sessions.
Alert on file creation events in webroot directories with executable script extensions using file integrity monitoring.
Correlate newly created files in upload directories with subsequent direct HTTP GET requests to the same paths.

Monitoring Recommendations

Enable verbose logging on the WordPress REST API and audit routes exposed by third-party plugins for missing permission_callback definitions.
Track subscriber account registrations and flag rapid transitions from account creation to plugin endpoint interaction.
Deploy endpoint and web server telemetry to detect PHP process spawns invoking shell commands or writing files outside expected paths.

How to Mitigate CVE-2026-16236

Immediate Actions Required

Deactivate the Realtyna Organic IDX plugin on all WordPress sites running version 5.3.0 or earlier until a vendor patch is available.
Disable open user registration or restrict the subscriber role from accessing the site until remediation completes.
Audit wp-content/uploads/ and plugin directories for unauthorized script files and remove any suspicious artifacts.
Rotate WordPress administrator credentials and API keys if compromise is suspected.

Patch Information

At time of publication, no fixed version of the Realtyna Organic IDX plugin has been referenced in the NVD entry. Consult the Wordfence Vulnerability Report and the WordPress plugin repository for the latest release information and apply updates as soon as a version above 5.3.0 becomes available.

Workarounds

Use a web application firewall (WAF) rule to block requests to admin-ajax.php with action=get_keys and to Realtyna REST API import routes originating from non-administrator sessions.
Enforce a server-level restriction that prevents PHP execution within the wp-content/uploads/ directory using web server configuration.
Restrict WordPress role capabilities so that subscribers cannot invoke plugin AJAX endpoints via a custom must-use plugin or role hardening.

bash

# Apache: block PHP execution inside WordPress uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7|php8)$">
    Require all denied
</FilesMatch>

# Nginx equivalent (add to server block)
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}