The Realtyna Organic IDX plugin for WordPress contains an arbitrary file upload vulnerability (CWE-434) in versions up to 5.3.0. The vulnerability arises from missing validation of file extensions and content in the saveLiveImages() function, insufficient authorization checks on the get_keys() AJAX handler, and a missing authentication check on the REST API import endpoint. These flaws enable authenticated attackers with subscriber-level privileges or higher to upload arbitrary files to the server, potentially leading to remote code execution.

An attacker with subscriber-level access or higher can upload arbitrary files to the affected server, which may allow execution of malicious code remotely. This compromises the confidentiality, integrity, and availability of the affected system, as indicated by the CVSS score of 8.8 with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to limit access to subscriber-level and above users, and monitor for suspicious file uploads. Avoid exposing the vulnerable plugin's endpoints publicly if possible.