MLS On The Fly WordPress plugin: SQL injection by subscribers

Summary

The WordPress plugin MLS On The Fly up to and including version 1.8.1.5 contains an SQL injection flaw (CWE-89). An authenticated user with the low-privilege Subscriber role can send crafted input that is passed unsanitised to the database. A successful attack could read, modify or delete database content, including user accounts and stored customer or lead data. Patchstack reports that no official patch is available yet, and the vendor attribution is unconfirmed.

Affected

• MLS On The Fly WordPress plugin, versions up to and including 1.8.1.5
• Vendor attribution unconfirmed: Realtyna (vendor page) or favethemes (VulDB)

Fixed in

Unknown. No patched version was confirmed in the sources at the time of research.

Workaround

Unknown from the sources reviewed. Options not verified against a vendor source:

• Restrict or disable subscriber self-registration
• Remove unneeded subscriber accounts
• Check whether the plugin is still needed
• A web application firewall may add some protection but is not a fix

Exploitation

• No evidence of in-the-wild exploitation; CISA KEV lists it as No
• VulDB states no exploit is available; no public proof of concept found
• EPSS 0.38 % (percentile 32)
• CISA SSVC: exploitation none, automatable no, technical impact partial

Our recommendation

• Check whether any client site runs this plugin and whether it allows open subscriber registration
• Disable open registration and remove unneeded subscriber accounts
• Consider deactivating the plugin if it is no longer required
• Monitor the Patchstack advisory and the vendor for a fixed release and apply it promptly
• Monitor web server and database logs for suspicious SQL errors or requests
• Use the NVD CVSS 3.1 vector (8.5) for prioritisation; other scores differ

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• Vulners CVE record vulners.com
• VulDB entry vuldb.com
• Realtyna MLS On The Fly realtyna.com
• CVE Threat Intelligence record cve.threatint.com
• Strix CVE record www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:47.