CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-1830 — The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution...

·Source: NIST NVD

Updated:

Executive Summary

The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.1. This is due to insufficient authorization checks on REST API endpoints that expose a sync code and allow arbitrary file uploads. This makes it possible for unauthenticated attackers to retrieve the sync code, upload PHP files with path traversal, and achieve remote code exe

Analysis

The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.1. This is due to insufficient authorization checks on REST API endpoints that expose a sync code and allow arbitrary file uploads. This makes it possible for unauthenticated attackers to retrieve the sync code, upload PHP files with path traversal, and achieve remote code execution on the server. CVSS Score: 9.8. Published: 2026-04-09T05:16:03.420.

Indicators of Compromise (1)

CVE (1)
CVE-2026-1830
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Apr 9, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

Citrix Ships Another Emergency Fix for NetScaler Appliances

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/citrix-ships-another-emergency-fix-for-netscaler-appliances-image_small-10-a-33054.jpg" align=right hspace=4><b>Keeping Score: It's Vendor's Third Patch in 2 Weeks to Address Exploitable Flaws</b><br>For the third time in two weeks, Citrix has shipped an emergency security fix for its NetScaler line of products. The vulnerability

Bank Info Security
MEDIUMVulnerability

Suspected ShinyHunters Extortion Hacker Arrested by FBI

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/suspected-shinyhunters-extortion-hacker-arrested-by-fbi-image_small-9-a-33059.jpg" align=right hspace=4><b>FBI Vows to Dismantle Hacking Group After It Stole FBI Personnel Data</b><br>The FBI announced Friday the arrest of a suspected hacker behind the breach of a bureau HR system, marking the second recent detention of an alleged

Bank Info Security
MEDIUMVulnerability

FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal Hack

The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X. ShinyHunters is the extortion group that said in September it had breached the FBI's jobs portal and stolen sensitive data on almost all FBI agents and job applicants. The FBI has not named the suspect, and no charges have been made public. The

The Hacker News