Sploitus

Exploit for CVE-2026-13714

githubexploit · 2026-08-02

Exploit Code

README119 lines
## https://sploitus.com/exploit?id=1274EBDA-404A-5970-B0D4-87A57CAA4FC3
# CVE-2026-13714
Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
# CVE-2026-13714 — WPL Real Estate Unauthenticated RCE

**Realtyna Organic IDX plugin + WPL Real Estate for WordPress             │
   │  ├─ private_key =             │
   │  ├─ cmd = set_property                   │
   │  └─ file[] = image_Nx_abc.php            │
   │─────────────────────────────────────────►│
   │                                          │ API validates keys ✓
   │                                          │ Saves file (no type check)
   │               {"success": true}          │
   │◄─────────────────────────────────────────│
   │                                          │
   │  GET /wp-content/uploads/WPL/{pid}/Nx_*  │
   │─────────────────────────────────────────►│
   │               PHP executed               │
   │◄─────────────────────────────────────────│
```

---

## Script Features

| Feature | Description |
|---|---|
| **WPL Fingerprinting** | `?get_realtyna_platform=1` probe + HTML signature detection |
| **WordPress Root Discovery** | Auto-detects WP installations in subdirectories (`/wp`, `/blog`, `/site`, etc.) |
| **Hardcoded Key Exploitation** | Uses the default I/O API keys shipped with every WPL install |
| **Multipart Upload** | Builds `file[]` multipart matching WPL's `set_property` expectations exactly |
| **PID Scanner** | Brute-forces `wp-content/uploads/WPL/{1..N}/` to locate the uploaded file |
| **Reverse PID Scan** | Scans newest PIDs first for faster discovery on active sites |
| **Canary Mode** | Safe `.txt` upload to verify write access without executing PHP |
| **Threaded Mass Scan** | Concurrent processing with configurable thread count (1–50) |
| **Nx-zD Signature** | Uploaded shells carry the `Nx-zD` verification tag |
| **Auto Logging** | Results saved to `Nx_hit/` with separate files per result type |

### Operating Modes

| Mode | What It Does |
|---|---|
| `1` — **Detect** | Fingerprint WPL installations without uploading anything |
| `2` — **Upload** | Upload `Nx_*.php` shell via the I/O API and verify execution |
| `3` — **Canary** | Upload `Nx_*.txt` (safe probe) to confirm write access only |

### Output Files

| File | Content |
|---|---|
| `Nx_hit/Nwpl_detect.txt` | WPL installations found (detect mode) |
| `Nx_hit/Nwpl_shell.txt` | Confirmed shell uploads with full URL and PID |
| `Nx_hit/Nwpl_canary.txt` | Canary verification results |

---

## Usage

```
python CVE-2026-13714.py
```

The script prompts for:

```
> Target list:    targets.txt
> Threads [1-50]: 10
> Mode [1/2/3]:   2
```

**Target list format** — one target per line:

```
example.com
https://site.com
http://192.168.1.10:8080
sub.domain.org/wordpress
```

### Requirements

- Python 3.8+
- No external dependencies (stdlib only)

---

## Remediation

- Update WPL Real Estate to **version 5.3.0** or later
- If immediate update is not possible:
  - Rotate the I/O API keys in the database (`wpl_settings` table)
  - Disable the I/O API entirely if not in use
  - Block direct access to `wp-content/uploads/WPL/` via server configuration

---

## Disclaimer

This tool is provided **strictly for authorized security testing and educational purposes**. Use it only on systems you own or have explicit written permission to test.

Unauthorized access to computer systems is illegal under laws including but not limited to the Computer Fraud and Abuse Act (CFAA), the UK Computer Misuse Act, and equivalent legislation worldwide.

The author assumes **no liability** for misuse. By using this tool you accept full responsibility for your actions and agree to comply with all applicable laws and regulations.

---

## Author

**Nxploited** — Khaled Alenazi

Telegram: [@Kxploit](https://t.me/Kxploit)

---

## References

- [NVD — CVE-2026-13714](https://nvd.nist.gov/vuln/detail/CVE-2026-13714)
- [WPScan — WPL Real Estate](https://wpscan.com/plugin/flavor)
- CVSS 3.1 Base Score: **9.8 CRITICAL** (CISA-ADP)