Unauthenticated Arbitrary File Upload in Realtyna Organic IDX + WPL Real Estate for WordPress

This repository is a small standalone exploit for CVE-2026-14483 and contains two files: a README describing the vulnerability and usage, and a single Python entry point, exploit.py. The exploit targets the Realtyna WPL / Organic IDX WordPress plugin (real-estate-listing-realtyna-wpl <= 5.2.0), abusing a publicly reachable I/O service exposed through the WordPress site root. It authenticates to that service using static hard-coded default keys that are identical across installations, then invokes the set_property command in the mobile_application command directory to upload an attacker-supplied file via multipart form data. The exploit’s main capability is unauthenticated remote code execution through arbitrary file upload. It uploads a PHP webshell whose filename is prefixed with image_ to satisfy the plugin’s expected naming behavior, relying on the vulnerable code to strip the prefix and save the file without extension or MIME validation. After upload, the script does not receive the created property ID directly, so it enumerates likely property directories under wp-content/uploads/WPL/1..80 until it finds the uploaded shell by issuing a benign echo marker command. Once located, it can either execute a single arbitrary command through the c GET parameter or trigger a bash reverse shell to an operator-supplied host and port. Structurally, exploit.py is straightforward: _get() performs HTTP GET requests and handles errors; upload() builds the vulnerable POST request with the required query parameters and multipart body; find_shell() brute-forces the upload directory path and validates shell execution using a marker string; main() parses arguments, generates a timestamp-based PHP filename, uploads the shell, locates it, and either runs a command or launches a reverse shell. The code uses only Python standard library modules (argparse, sys, time, urllib.*), making it dependency-free and easy to run. This is a real exploit rather than a detector, and because it includes a working webshell payload and reverse-shell option, it is best classified as OPERATIONAL.

This repository contains a single Python exploit script and a README. The exploit targets CVE-2026-14483 in the Realtyna WPL Real Estate Listing WordPress plugin and is designed for mass exploitation against multiple base URLs using concurrent threads. The script structure includes banner/output helpers, a WPLExploit class for single-target exploitation, and a MassExploit workflow that loads targets from a file and processes them in parallel. Core capability: unauthenticated RCE via webshell upload. The exploit first fingerprints the plugin version by requesting plugin files under /wp-content/plugins/real-estate-listing-realtyna-wpl/, preferring readme.txt and falling back to wpl.php. It then retrieves exposed API credentials from a public SQL migration dump, uses those credentials to call the WPL I/O API action set_property, and uploads a PHP payload disguised as an image. Finally, it brute-forces property IDs up to a configurable maximum to locate the uploaded shell under /wp-content/uploads/WPL/{id}/0x89MADEXPLOITS.php. The default payload is an embedded PHP upload shell that prints the marker MADEXPLOITS and provides a form-based arbitrary file upload capability, making the exploit more than a simple proof of concept. The script supports custom payloads, configurable user ID ownership, timeout, thread count, debug logging, and a --force option to bypass the version gate. Overall, this is a real exploit, not merely a detector, and it is operational but not framework-based.