HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-16236 — The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Up...

·Source: NIST NVD

Updated:

Executive Summary

The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to missing file extension and content validation in the saveLiveImages() function combined with an insufficient authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. This makes it possible for auth

Analysis

The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to missing file extension and content validation in the saveLiveImages() function combined with an insufficient authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSS Score: 8.8. Published: 2026-07-31T07:16:27.257.

Indicators of Compromise (1)

CVE (1)
CVE-2026-16236
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 31, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Lloyds Banking Group and Caixabank complete tokenised deposit transactions through Project Agorá

Lloyds Banking Group has completed three live tokenised deposit transactions through tokenisation initiative Project Agorá.

Finextra
MEDIUMVulnerabilityNEW

Google AI Uncovers 13-Year-Old Chrome Flaw Amid Record Patching Pace

The internet giant has built an agent harness to find vulnerabilities across Chrome’s codebase. The post Google AI Uncovers 13-Year-Old Chrome Flaw Amid Record Patching Pace appeared first on SecurityWeek .

SecurityWeek
MEDIUMVulnerabilityNEW

FinregE publishes framework in preparation for FCA's 2026 Cryptoasset Regime

FinregE, The End-to-End Regulatory Operating System (FinregE ROS), is urging digital asset firms to fundamentally change how they prepare for the UK's regulatory landscape. To achieve this, the company has introduced a strategic framework to bridge the widening “Execution Gap” ahead of the 2026 Financial Conduct Authority (FCA) Cryptoasset Regime.

Finextra