The Realtyna Organic IDX plugin suffers from an unrestricted file upload vulnerability (CWE-434) that permits attackers with high privileges to upload files of dangerous types, enabling code injection. This vulnerability affects all versions up to 4.14.13. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No patch or official remediation has been published yet, and the plugin is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an attacker with high privileges to upload malicious files, resulting in code injection that compromises the confidentiality, integrity, and availability of the affected system. This could lead to full system compromise or disruption of service. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's file upload functionality to trusted users only and monitor for suspicious activity related to file uploads. Avoid exposing the plugin to untrusted users or networks.