The Realtyna Organic IDX plugin (version <= 5.0.0) contains a CSRF vulnerability that can be exploited to trigger PHP Local File Inclusion. This vulnerability allows remote attackers to induce authenticated users to perform unwanted actions, potentially leading to the inclusion of local files on the server. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and user interaction needed.

Successful exploitation can lead to disclosure of sensitive local files, modification of data, and disruption of service on affected installations of the Realtyna Organic IDX plugin. The vulnerability impacts confidentiality, integrity, and availability at a high level. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or restricting access to trusted users only. Monitor the vendor's communications for updates on patches or official mitigations.