The Realtyna Organic IDX plugin suffers from an improper control of code generation vulnerability classified as code injection, enabling remote code inclusion. This flaw affects all versions up to and including 5.2.0. The vulnerability has a CVSS 3.1 base score of 10.0, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and complete confidentiality, integrity, and availability impact. No vendor advisory or patch information is available at this time, and no known exploits in the wild have been reported.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on the affected system, potentially leading to full system compromise including complete loss of confidentiality, integrity, and availability of the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the Realtyna Organic IDX plugin if feasible, or applying any available temporary mitigations recommended by the vendor once published.