This vulnerability (CVE-2026-45439) involves improper neutralization of special elements used in an SQL command (CWE-89) within the Realtyna Organic IDX plugin. It allows unauthenticated attackers to perform SQL Injection attacks on versions up to 5.1.0, enabling them to access sensitive data (high confidentiality impact) and cause limited disruption to availability. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and a scope change. No vendor advisory or patch information is available at this time.

The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands, leading to a high impact on confidentiality by potentially exposing sensitive data. Integrity is not impacted according to the CVSS vector, but availability impact is low, indicating some disruption is possible but limited. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the affected plugin to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.