{"id":"CVE-2026-125852","kind":"vulnerability","aliases":["CVE-2026-125852"],"related":[],"title":"Realtyna Organic IDX WordPress plugin: path traversal flaw through version 5.5.0","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Path Traversal.This issue affects Realtyna Organic IDX plugin: from n/a through 5.5.0.","summary":"The Realtyna Organic IDX WordPress plugin does not restrict file paths to the intended directory, so a crafted request can reach files outside it. The sources say the flaw allows path traversal; they do not say what files can be read or written.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","plugin","real-estate","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Organic IDX plugin version in the WordPress admin plugin list or the plugin's main file header; `unknown` for the exact path on your install\n- Versions through `5.5.0` are listed as affected by the NVD entry","fix":"- Realtyna Organic IDX: unknown (sources give no fixed version)","status":"open","published_at":"2026-11-13T15:17:42+00:00","first_seen_at":"2026-11-13T15:46:19+00:00","triaged_at":"2026-11-13T15:48:24+00:00","updated_at":"2026-11-13T15:48:24+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-13T15:48:24Z","model":"claude-haiku-5-5","output":{"fix":"- Realtyna Organic IDX: unknown (sources give no fixed version)","reach":"internet","title":"Realtyna Organic IDX WordPress plugin: path traversal flaw through version 5.5.0","impact":"medium","summary":"The Realtyna Organic IDX WordPress plugin does not restrict file paths to the intended directory, so a crafted request can reach files outside it. The sources say the flaw allows path traversal; they do not say what files can be read or written.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","real-estate","plugin"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown files on the web server may be read or altered","analyst_note":"Find the vendor or Wordfence advisory for the fixed version and whether authentication is required; the NVD entry alone gives no fix.","how_to_check":"- Check the installed Organic IDX plugin version in the WordPress admin plugin list or the plugin's main file header; `unknown` for the exact path on your install\n- Versions through `5.5.0` are listed as affected by the NVD entry","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Realtyna Organic IDX WordPress plugin (real-estate-listing-realtyna-wpl) at version 5.5.0 or earlier are listed as affected. The sources do not say whether an account is needed or what the attacker can reach, so teams should assume the plugin's endpoints are reachable from the internet.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":4576,"output_tokens":604,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125852':14A,17A '-2026':13A,16A '5.5.0':11A,103C 'affect':95C 'allow':53B,91C 'craft':41B 'cve':12A,15A 'directori':38B,75C 'estat':22B,87C 'file':33B,45B,61B 'flaw':8A,52B 'idx':3A,27B,83C,98C 'improp':67C 'intend':37B 'issu':94C 'limit':68C 'list':88C 'n/a':101C 'organ':2A,26B,82C,97C 'outsid':46B 'packag':18B 'path':6A,34B,54B,76C,92C 'pathnam':71C 'plugin':5A,19B,29B,84C,99C 'reach':44B 'read':64B 'real':21B,86C 'real-est':20B 'real-estate-listing-realtyna-wpl':85C 'realtyna':1A,25B,80C,81C,89C,96C 'request':42B 'restrict':32B,74C 'say':50B,59B 'sourc':49B 'travers':7A,55B,77C 'traversal.this':93C 'version':10A 'vulner':78C 'wordpress':4A,23B,28B 'wpl':90C 'written':66B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Realtyna Organic IDX WordPress plugin (real-estate-listing-realtyna-wpl) at version 5.5.0 or earlier are listed as affected. The sources do not say whether an account is needed or what the attacker can reach, so teams should assume the plugin's endpoints are reachable from the internet.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","plugin","realestate","wordpress"],"campaign_type":null,"search_a":"'-125852':14A,17A '-2026':13A,16A '5.5.0':11A 'cve':12A,15A 'flaw':8A 'idx':3A 'organ':2A 'path':6A 'plugin':5A 'realtyna':1A 'travers':7A 'version':10A 'wordpress':4A","search_b":"'allow':53B 'craft':41B 'directori':38B 'estat':22B 'file':33B,45B,61B 'flaw':52B 'idx':27B 'intend':37B 'organ':26B 'outsid':46B 'packag':18B 'path':34B,54B 'plugin':19B,29B 'reach':44B 'read':64B 'real':21B 'real-est':20B 'realtyna':25B 'request':42B 'restrict':32B 'say':50B,59B 'sourc':49B 'travers':55B 'wordpress':23B,28B 'written':66B","search_c":"'5.5.0':103C 'affect':95C 'allow':91C 'directori':75C 'estat':87C 'idx':83C,98C 'improp':67C 'issu':94C 'limit':68C 'list':88C 'n/a':101C 'organ':82C,97C 'path':76C,92C 'pathnam':71C 'plugin':84C,99C 'real':86C 'real-estate-listing-realtyna-wpl':85C 'realtyna':80C,81C,89C,96C 'restrict':74C 'travers':77C 'traversal.this':93C 'vulner':78C 'wpl':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125852","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125852","severity":null,"published_at":"2026-11-13T15:17:42+00:00","modified_at":"2026-11-13T15:17:42+00:00","first_seen_at":"2026-11-13T15:46:19+00:00","fetched_at":"2026-11-13T15:46:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}