CVE-2026-1830 is a critical remote code execution vulnerability in the Quick Playground WordPress plugin by davidfcarr. The issue arises from insufficient authorization on REST API endpoints that expose a sync code and permit arbitrary file uploads. Attackers can exploit this to upload PHP files with path traversal sequences, enabling execution of malicious code on the affected server. This vulnerability affects all versions up to and including 1.3.1. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation is currently documented.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the server hosting the vulnerable Quick Playground plugin. This can lead to full compromise of the affected WordPress site, including data theft, site defacement, or use of the server for further attacks. The vulnerability impacts confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or uninstall the Quick Playground plugin to prevent exploitation. Monitor for updates from the vendor or trusted security sources for an official patch or mitigation instructions.