CVE-2026-1830
Published: 09 April 2026
Description
The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.1. This is due to insufficient authorization checks on REST API endpoints that expose a sync code and allow arbitrary file…
more
uploads. This makes it possible for unauthenticated attackers to retrieve the sync code, upload PHP files with path traversal, and achieve remote code execution on the server.
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for logical access to system resources, directly mitigating the insufficient authorization checks on REST API endpoints that expose sync codes.
Validates and sanitizes inputs to REST API endpoints, preventing path traversal and arbitrary PHP file uploads leading to RCE.
Identifies, reports, and remediates flaws like the vulnerable code in api.php and expro-api.php of Quick Playground plugin versions up to 1.3.1.
Security SummaryAI
CVE-2026-1830, published on 2026-04-09, is a critical remote code execution vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) linked to CWE-862 (Missing Authorization). It affects the Quick Playground plugin for WordPress in all versions up to and including 1.3.1. The flaw stems from insufficient authorization checks on REST API endpoints that expose a sync code and allow arbitrary file uploads.
Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By first retrieving the exposed sync code, they can upload malicious PHP files via path traversal, achieving remote code execution on the server.
Advisories referenced in the WordPress plugins trac repository identify vulnerable code at api.php line 39 and expro-api.php line 419, with changeset 3500839 documenting changes to the Quick Playground plugin. Wordfence threat intelligence (vulnerability ID 308cd28a-a477-4bc6-a392-ad5a9eca1cb5) provides additional details on the issue.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote code execution via exploitation of a public-facing WordPress plugin's REST API endpoints with missing authorization, enabling arbitrary PHP file uploads through path traversal.