CVE-2026-1830

The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.1. This is due to insufficient authorization checks on REST API endpoints that expose a sync code and allow arbitrary file uploads. This makes it possible for unauthenticated attackers to retrieve the sync code, upload PHP files with path traversal, and achieve remote code execution on the server.

• CWE-862

• https://plugins.trac.wordpress.org/browser/quick-playground/trunk/api.php#L39
• https://plugins.trac.wordpress.org/browser/quick-playground/trunk/expro-api.php#L419
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3500839%40quick-playground&new=3500839%40quick-playground&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/308cd28a-a477-4bc6-a392-ad5a9eca1cb5?source=cve

Published

Apr 9, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18294OriginLab Origin Viewer OGW File Parsing Memory Corruption R…7.8
• CVE-2026-18295GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code E…7.8
• CVE-2026-18296GStreamer MRF File Parsing Heap-based Buffer Overflow Remote…7.8
• CVE-2026-18297GStreamer OGG File Parsing Stack-based Buffer Overflow Remot…7.8
• CVE-2026-18298GStreamer PNG File Parsing Heap-based Buffer Overflow Remote…7.8
• CVE-2026-18299GStreamer rtpsbcdepay Use-After-Free Remote Code Execution V…7.8
• CVE-2026-18300GIMP HDR File Parsing Integer Overflow Remote Code Execution…7.8
• CVE-2026-18301GIMP PSD File Parsing Integer Overflow Remote Code Execution…7.8
• CVE-2026-18302GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code…7.8
• CVE-2026-18303GIMP TIF File Parsing Stack-based Buffer Overflow Remote Cod…7.8
• CVE-2026-18304GIMP TIF File Parsing Integer Overflow Remote Code Execution…7.8
• CVE-2026-18305GIMP TIF File Parsing Integer Overflow Remote Code Execution…7.8