Quick Playground

Quick Playground has 3 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 3 are fixed as of August 2026. Their average CVSS score is 7.2, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2026 was the busiest year with 3 disclosures.

The most common weakness is Path Traversal, behind 2 of the records (67%). Other recurring categories include Missing Authorization.

Every one of the 3 issues recorded for Quick Playground has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, most of them (2) reported by Athiwat Tiprasaharn (Jitlada). Quick Playground is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSHigh
7.2/ 10
Patch Coverage100%
Open

0

Fixed

3

Get automatic notifications for all Quick Playground vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-1830

Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload

Read the full analysis

Vulnerability Records

3 records
Quick Playground banner
Latestv1.3.5

Quick Playground

davidfcarr

Author

davidfcarr

0.0(0)
0/100
Last Updated
2026-06-02 (2mo ago)
Active Installs
10+
Downloads
1,670
Requires WP
6.2+
Requires PHP
0+
Tested up to
WP 6.9.7
Created
2025-09-16 (11mo ago)

The Quick Playground plugin provides a safe and convenient way to test new designs and features for your WordPress website, or to create demos and share proposed design changes. It creates a clone of your website’s home page and key content, allowing you to experiment with plugins, themes, and design changes without affecting your live website. The plugin takes advantage of WordPress Playground, the innovative software that simulates a complete PHP/WordPress/database server environment running in your web browser for testing and experimentation. Quick Playground simplifies the creation of Playground Blueprints, which define steps such as installing themes and plugins and loading content. No need to hand-code JSON or arrange for code to be served from Github. This plugin is ideal for developers and designers who want to test new ideas without disrupting their live website. Features: Clone your website’s home page and key content for testing purposes. For performance reasons, the plugin does not attempt to clone your entire database. Experiment with themes and plugins, including unpublished custom code. Test new block theme design customizations in a WordPress Playground environment before implementing them on your live site. Save changes for future playground sessions, allowing you to keep experimenting. Create demo environments separate from your live website content, for example to showcase themes, plugins, or hosting services. Sync changes back to your live website. For example, you can prototype block theme changes in Playground and copy the updated templates or template parts back to the live site. Define pop-up prompts / help tips to be displayed on any front end or admin page within the playground environment. Works on WordPress multisite (clones the individual site, not the whole network). The multisite network administrator can set default themes and plugins to include or exclude. Note: some of these features were previously reserved for a “Pro” version but are now available for free. You’re welcome. Learn more at quickplayground.com Developer Friendly Features Source code on GitHub Examples of Using the Filters and Actions How it Works You can create multiple Playground profiles, each of which can specify different themes, plugins, playgrounds, content, and settings. The Playground Blueprint is created for you, stored on your server as a PHP associative array, and served to the Playground as JSON file with the same data hierarchy. When a Playground is launched, it loads the themes, plugins, and content specified in your BluePrint. Any custom themes and plugins not in the WordPress repository will be archived on your server as ZIP files and downloaded on demand. Quick Playground loads a copy of itself into the Playground environment and assists with copying over content. If you obtain a Pro license key, a plugin with additional capabilities for saving and syncing content will be loaded into the Playground (not your live website). License This plugin is licensed under the GPLv2 or later. See the GNU General Public License for more details. External services Users may configure Quick Playground to display content from other websites that also run Quick Playground.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C