The Quick Playground WordPress plugin version 1.3.1 and earlier is vulnerable to unauthenticated remote code execution. This means an attacker can remotely execute arbitrary code on a WordPress site running this plugin without needing to authenticate. The vulnerability affects all versions up to and including 1.3.1. There is no information about an available patch or vendor advisory. The environment tags indicate this may be relevant for WordPress 6.x running on typical web stacks such as Docker, Debian, Apache, and PHP 8.2.

Successful exploitation of this vulnerability allows an unauthenticated attacker to execute arbitrary code on the affected WordPress site. This can lead to full site compromise, data theft, defacement, or further attacks on the hosting environment. The critical severity reflects the high risk posed by remote code execution without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, consider disabling or removing the Quick Playground plugin version 1.3.1 or earlier to prevent exploitation. Monitor official vendor channels for updates and apply any released patches promptly.