# CVE-2024-32128: Realtyna Organic IDX plugin - SQLi

> Live exploitation tracking for CVE-2024-32128 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-32128

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.3
- **Public exploit available:** Yes
- **Affected products:** Realtyna Organic IDX plugin
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** wordpress, cms

## Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Realtyna Realtyna Organic IDX plugin.This issue affects Realtyna Organic IDX plugin: from n/a through 4.14.4.

## CrowdSec analysis

[CVE-2024-32128](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-32128) is a critical SQL injection vulnerability in the Realtyna Organic IDX plugin, affecting versions up to 4.14.4. This flaw allows remote, unauthenticated attackers to inject malicious SQL commands, potentially exposing sensitive database information and compromising the security of affected WordPress sites.

CrowdSec has been tracking this vulnerability and its exploits since 30th of March 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-32128 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by sending crafted requests to endpoints with parameters like `wpl_format=f:property_listing:ajax` and `wpl_function=get_total_results`, injecting SQL code via the `sf_tmin_price` parameter to execute arbitrary SQL commands against the database.

## Timeline

- 2024-04-15: CVE Published. CVE-2024-32128 is published to NVD.
- 2026-03-30: Rule Released. CrowdSec releases a rule to detect CVE-2024-32128 exploitation attempts against the CrowdSec Network.
- 2026-10-06: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-32128 for the first time.

## References

- https://patchstack.com/database/vulnerability/real-estate-listing-realtyna-wpl/wordpress-realtyna-organic-idx-plugin-wpl-real-estate-plugin-4-14-4-unauthenticated-sql-injection-vulnerability?_s_id=cve
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32128.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-32128) follows observed exploitation activity for CVE-2024-32128. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.