A critical vulnerability in the Quick Playground WordPress plugin lets attackers upload arbitrary files and achieve remote code execution — no login required. Tracked as CVE-2026-1830, the bug affects all versions up to and including 1.3.1.
The plugin exposes a REST API endpoint at /wp-json/quickplayground/v1/upload_image/{profile} meant for handling image uploads. Validation hinges on a sync_code value that gets checked with a simple string comparison. If the sync_code is known, weak, reused, or predictable, an attacker can bypass the check entirely.
From there, path traversal sequences in the filename parameter let the attacker write a PHP webshell to an executable directory on the server. Once the shell is in place, the attacker can run any command the web server user has permission to execute. The whole chain requires no WordPress authentication or capability checks of any kind.
In a proof-of-concept, researchers demonstrated the attack against a standard WordPress 6.x installation running on PHP 8.2 with Apache. A single crafted POST request delivered the webshell and confirmed command execution.
If you have this plugin installed, remove it or update patched version immediately. Even if you think your sync_code is strong, consider it compromised — the vulnerability is structural, not dependent on a specific code value. And audit your uploads directory for any unexpected PHP files.
