PT-2026-31577 · David F. Carr · Quick Playground

Athiwat Tiprasaharn + 3 · Published 2026-04-09 · Updated 2026-04-09 · CVE-2026-1830

NVD

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.1. This is due to insufficient authorization checks on REST API endpoints that expose a sync code and allow arbitrary file uploads. This makes it possible for unauthenticated attackers to retrieve the sync code, upload PHP files with path traversal, and achieve remote code execution on the server.

Fix

RCE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1830

Affected Products

Quick Playground

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-1830 · Security Note
• https://twitter.com/0dayPublishing/status/2042096312519156043 · Twitter Post
• https://twitter.com/CveFindCom/status/2042116020668658094 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3500839%40quick-playground&new=3500839%40quick-playground&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/2042101273198018643 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/308cd28a-a477-4bc6-a392-ad5a9eca1cb5?source=cve · Note
• https://twitter.com/OrizonCyber/status/2042112790668754967 · Twitter Post
• https://twitter.com/infoflowcloud/status/2042103043961901535 · Twitter Post
• https://plugins.trac.wordpress.org/browser/quick-playground/trunk/expro-api.php#L419 · Note
• https://plugins.trac.wordpress.org/browser/quick-playground/trunk/api.php#L39 · Note