CVE-2026-1830

BRIEFING NOTE: CVE-2026-1830 The Quick Playground plugin for WordPress versions up to 1.3.1 is vulnerable to unauthenticated remote code execution due to insufficient authorization controls on REST API endpoints. Attackers can exploit exposed endpoints to retrieve a sync code, upload malicious PHP files using path traversal techniques, and execute arbitrary code on affected servers. This vulnerability impacts any WordPress installation running the affected plugin versions without proper patching. The vulnerability carries a CVSS score of 9.8 (Critical) with a network-based attack vector requiring no authentication, low complexity, and no user interaction. The attack results in complete compromise of confidentiality, integrity, and availability. An unauthenticated attacker can remotely execute code with server privileges, representing a maximum severity threat to affected systems. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and remains inactive on exploit tracking lists, indicating no widespread active exploitation at this time. However, the relatively low EPSS score and community attention level suggest limited public exploit availability. Organizations should prioritize patching to versions beyond 1.3.1 as a preventative measure given the critical severity rating and ease of exploitation.