What is GHSA-wvhc-cw3f-mchc?

GHSA-wvhc-cw3f-mchc is a security advisory published by GitHub Security Advisories with unknown severity. The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate...

Which CVE IDs does GHSA-wvhc-cw3f-mchc cover?

GHSA-wvhc-cw3f-mchc covers the following CVE IDs: CVE-2026-13714. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-wvhc-cw3f-mchcunknown

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate...

Vendor

GitHub Security Advisories

Published

July 27, 2026

Last Modified

July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-13714 →

📋 Description

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-13714
https://wpscan.com/vulnerability/69f9dcd8-ab3c-46ed-ac6b-2f1db35f8d1f
https://github.com/advisories/GHSA-wvhc-cw3f-mchc