CVE Intelligence
Analysis AI-assisted

CVE-2026-1830: Quick Playground WordPress Plugin: Missing Authorization Leading to Remote Code Execution

CVE-2026-1830 affects the Quick Playground plugin for WordPress in all versions up to and including 1.3.1. According to the record, missing authorization checks on REST API endpoints can let unauthenticated attackers reach remote code execution, with a CVSS 3.1 score of 9.8 (critical). The record shows no confirmed exploitation in the wild and no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The Quick Playground plugin for WordPress is affected by CVE-2026-1830. The record describes a missing authorization issue (CWE-862) in REST API endpoints that expose a sync code and allow arbitrary file uploads, which can lead to remote code execution on the server.

Impact

  • The record states that unauthenticated attackers can retrieve the sync code, upload files and achieve remote code execution on the server.
  • The CVSS 3.1 base score of 9.8 (critical) is provided by security@wordfence.com. The vector indicates network access, low complexity, no privileges required and no user interaction, with high impact to confidentiality, integrity and availability.

Affected products and versions

  • The record states that all versions up to and including 1.3.1 are vulnerable.
  • The structured affected and fixes lists in the record are empty, so no fixed version is confirmed. The absence of a listed fix does not mean that no fix exists.

Exploitation status

  • The record shows kev.listed as false, so this CVE is not listed in the CISA KEV catalog in the record. No confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS data in the record gives a probability of 0.08095 and a percentile of 0.94712.

Remediation and mitigation

  • Identify whether the Quick Playground plugin is installed and which version is in use. Treat versions up to and including 1.3.1 as in scope according to the record.
  • Review the Wordfence entry and the WordPress plugin repository references for updates, and apply a fixed release from the plugin maintainer once its availability is verified.
  • Until a fix is confirmed, consider deactivating and removing the plugin on sites where it is not essential, and restrict access to the affected REST API routes at the network or web application layer where feasible.
  • Review sites for unexpected PHP files in upload and plugin directories.

Detection guidance

  • Review web server and application logs for unusual requests to the plugin's REST API routes, especially from unauthenticated sources.
  • Monitor file integrity for newly created PHP files in writable directories.
  • Look for unexpected administrator accounts or unfamiliar scripts on the server.

Limitations of the available information

  • The record does not provide a fixed version or a verified affected range beyond the statement up to and including 1.3.1.
  • The English title was missing from the record; the titles in this analysis were written for the portal.
  • The record status is Deferred, and the sources consulted do not explain what this status means.
  • Exploitation details are intentionally omitted from this analysis.

Frequently asked questions

Which versions of Quick Playground are affected by CVE-2026-1830?

According to the record, all versions up to and including 1.3.1 are vulnerable. The record does not list a fixed version.

Is CVE-2026-1830 being actively exploited?

The record shows that this CVE is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.

What should site owners do now?

Identify whether the plugin is installed, check its version, apply a verified fixed release when available, and consider removing the plugin where it is not essential.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.