PT-2026-41275 · WordPress · Quick Playground
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Quick Playground versions prior to 1.3.4
Description
The Quick Playground plugin for WordPress contains a path traversal flaw. This occurs because the
qckply zip theme() function fails to properly validate the stylesheet parameter, which is appended to the theme root directory path without sanitizing directory traversal sequences. Consequently, unauthenticated attackers can trigger the creation of a ZIP archive containing arbitrary files from the server's filesystem, such as the wp-config file.Recommendations
Update the plugin to a version later than 1.3.3.
As a temporary workaround, restrict access to the
qckply zip theme() function to minimize the risk of exploitation.Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Quick Playground