CVE-2026-45439: WordPress Realtyna Organic IDX plugin plugin <= 5.1.0 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability exists in the Realtyna Organic IDX plugin for WordPress, affecting all versions up to and including 5.1.0. The flaw is reachable over the network with no credentials required and no victim interaction needed, making it trivially exploitable by any external attacker who can reach the WordPress site. Successful exploitation gives the attacker read access to the underlying database contents and causes limited availability disruption to the affected service. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the WordPress installation to reach it.

• AuthenticationNot required

  No account or credential of any kind is needed; the injected payload can be sent by any unauthenticated request.

• Victim interactionNot required

  No user action is required; the attacker sends the malicious request directly to the server without involving any logged-in user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or knowledge of the target environment.

Blast Radius

• The attacker can read arbitrary rows from the WordPress database, including stored user credentials (hashed passwords), email addresses, and any real-estate listing data managed by the plugin.
• Because WordPress sites commonly store session tokens, API keys, and plugin license keys in the database, those secrets are exposed to direct extraction.
• The CVSS availability impact is rated low, meaning the attacker can cause partial disruption to the database service or site responsiveness as a side effect of crafted queries.