CVE-2026-14483 describes an arbitrary file upload vulnerability in the Realtyna Organic IDX plugin and WPL Real Estate plugin for WordPress, affecting all versions up to 5.2.0. The vulnerability arises from missing file type validation in the upload function combined with a publicly accessible I/O endpoint that authenticates solely via static API credentials seeded by the plugin's SQL migration files. These static credentials are identical across all installations and publicly documented, allowing unauthenticated attackers to exploit the upload function to upload executable files, potentially enabling remote code execution. The vulnerable endpoint is registered on the WordPress init hook without capability checks, further facilitating exploitation.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, including executable code, to affected WordPress sites running the vulnerable plugins. This can lead to remote code execution, complete site compromise, data loss, and potential further network penetration. The vulnerability has a CVSS 3.1 score of 9.8 (critical), indicating high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or remove the affected plugins if possible. Restrict access to the vulnerable upload endpoint and change any static API credentials if configurable. Monitor for updates from Realtyna regarding patches or official mitigations.