CVE-2024-38736 CRITICAL

CVE-2024-38736: WordPress Realtyna Organic IDX plugin <= 4.14.13 - Arbitrary File Upload vulnerability

Vendor Realtyna
Product Realtyna Organic IDX plugin
Weakness CWE-434 · Unrestricted file upload
Published July 12, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type vulnerability in Realtyna Realtyna Organic IDX plugin allows Code Injection.This issue affects Realtyna Organic IDX plugin: from n/a through 4.14.13.

Explanation of Vulnerability in Simple Terms

02Summary

The Realtyna Organic IDX plugin through version 4.14.13 does not properly validate file uploads, allowing authenticated administrators to upload arbitrary files to the server. An attacker with admin credentials can upload malicious files—such as PHP scripts—to execute code on the site. This vulnerability affects the entire site and any data it hosts.

What an attacker can do

03Attacker Capabilities

Upload and execute arbitrary files (such as PHP scripts) on the server to run their own code.

Potential impact on your site

04Site Impact

A compromised admin account can lead to full site takeover, data theft, malware installation, and defacement.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the WordPress site.

Key dates

06Disclosure timeline

July 12, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-42748 WordPress WPify Woo Czech plugin <= 5.4.1 - Arbitrary File Upload vulnerability CVE-2026-58480 Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments CVE-2026-63048 Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 CVE-2026-15158 Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter CVE-2026-56290 Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0