CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Remote Code Inclusion.This issue affects Realtyna Organic IDX plugin: from n/a through <= 5.2.0.
Explanation of Vulnerability in Simple Terms
The Realtyna Organic IDX plugin through version 5.2.0 contains a code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code on affected sites. No user interaction is required. The vulnerability affects the entire site and can lead to complete compromise, including data theft, malware installation, and site takeover.
What an attacker can do
Run arbitrary PHP code on the site without authentication.
Potential impact on your site
Complete site compromise: attackers can steal data, install malware, modify content, or take full control.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
