What is the CVSS score of CVE-2026-1830?

CVE-2026-1830 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2026-1830?

The Quick Playground WordPress plugin (versions ≤1.3.1) contains a critical remote code execution vulnerability that allows unauthenticated attackers to completely compromise affected web servers…

Is there a public PoC exploit available for CVE-2026-1830?

Yes, a public proof-of-concept exploit is available for CVE-2026-1830. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-1830?

Within 24 hours: Disable or immediately remove the Quick Playground plugin from all WordPress installations; if removal is not possible, restrict network access to the affected WordPress site using WAF rules or IP allowlisting. Within 7 days: Conduct forensic analysis of server logs and file systems for indicators of compromise dating back to plugin installation; rotate all server credentials, database passwords, and API keys. Within 30 days: Identify and deploy a maintained alternative plugin or custom solution for required Quick Playground functionality; implement application-level access controls on all REST API endpoints and enforce authentication on file upload operations.

PHP CVE-2026-1830

EUVD-2026-20843 CRITICAL

Missing Authorization (CWE-862)

2026-04-09 Wordfence

GHSA-8jp3-8878-6q85

PHP WordPress Authentication Bypass RCE Path Traversal Quick Playground Wordpress Plugin Davidfcarr

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 09, 2026 - 04:30 euvd

EUVD-2026-20843

Analysis Generated

Apr 09, 2026 - 04:30 vuln.today

CVE Published

Apr 09, 2026 - 03:25 nvd

CRITICAL 9.8

DescriptionCVE.org

The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.1. This is due to insufficient authorization checks on REST API endpoints that expose a sync code and allow arbitrary file uploads. This makes it possible for unauthenticated attackers to retrieve the sync code, upload PHP files with path traversal, and achieve remote code execution on the server.

AnalysisAI

Remote code execution in Quick Playground plugin for WordPress (all versions through 1.3.1) allows unauthenticated attackers to execute arbitrary PHP code on the server. Vulnerability stems from insufficient authorization on REST API endpoints that expose a sync code and permit unrestricted file uploads. Attackers can retrieve the sync code via unsecured endpoints, upload malicious PHP files using path traversal techniques, and achieve full server compromise without authentication. CVSS 9.8 critical severity. No public exploit identified at time of analysis.

Technical ContextAI

Root cause is CWE-862 missing authorization enforcement on REST API routes in api.php and expro-api.php. Endpoints leak sync codes and accept arbitrary file uploads without validating authentication tokens or sanitizing file paths. Attackers combine exposed sync code retrieval with path traversal in upload handlers to place PHP payloads outside intended directories, bypassing plugin directory restrictions and enabling webshell deployment.

RemediationAI

Vendor-released patch: version 1.3.2 addresses authorization bypass and file upload vulnerabilities per changeset 3500839. Upgrade immediately to Quick Playground 1.3.2 or later via WordPress admin dashboard or https://wordpress.org/plugins/quick-playground/. If immediate patching is not feasible, deactivate and remove the Quick Playground plugin entirely until upgrade can be performed, as no effective workaround exists for unauthenticated RCE. Review server logs for suspicious PHP file uploads or unauthorized REST API access to /wp-json/quick-playground/ endpoints. Consult vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/308cd28a-a477-4bc6-a392-ad5a9eca1cb5?source=cve for additional technical details and indicators of compromise.