Vulnerability · Published Apr 9, 2026 · Assigned by Wordfence

CVE-2026-1830Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload

Critical 9.8

In plain English

A critical-severity missing authorization in Quick Playground from davidfcarr. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 8.1% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)8.1%top 5.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.1. This is due to insufficient authorization checks on REST API endpoints that expose a sync code and allow arbitrary file uploads. This makes it possible for unauthenticated attackers to retrieve the sync code, upload PHP files with path traversal, and achieve remote code execution on the server.

Affected products (as reported)

Vendor	Product	Versions
davidfcarr	Quick Playground	0 – through 1.3.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References