CVE-2026-1830 | The Quick Playground plugin for WordPress is vulnerable to R… | CVSS 9.8 CRITICAL

Description

The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.1. This is due to insufficient authorization checks on REST API endpoints that expose a sync code and allow arbitrary file uploads. This makes it possible for unauthenticated attackers to retrieve the sync code, upload PHP files with path traversal, and achieve remote code execution on the server.

Metadata

CVE ID: CVE-2026-1830
State: PUBLISHED
Assigner: Wordfence
Reserved: 2026-02-03 14:35 UTC
Published: 2026-04-09 03:25 UTC
Last updated: 2026-04-09 13:34 UTC
Primary CWE: CWE-862
CWE-862 Missing Authorization
Vendor / Product: davidfcarr / Quick Playground
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
davidfcarr	Quick Playground	—	0 ≤ 1.3.1

Weakness (CWE)

CWE	Source	Description
CWE-862	cna	CWE-862 Missing Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (4)