PT-2026-41275 · David F. Carr · Quick Playground

Athiwat Tiprasaharn + 1 · Published 2026-05-15 · Updated 2026-05-15 · CVE-2026-6403

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The Quick Playground plugin for WordPress is vulnerable to Path Traversal in versions up to and including 1.3.3. This is due to insufficient path validation in the qckply zip theme() function, which appends a user-controlled 'stylesheet' parameter directly to the theme root directory path without sanitizing directory traversal sequences. This makes it possible for unauthenticated attackers to trigger the creation of a ZIP archive containing arbitrary files from the server's filesystem — including wp-config.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-6403

Affected Products

Quick Playground

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-6403 · Security Note
• https://plugins.trac.wordpress.org/browser/quick-playground/trunk/api.php#L631 · Note
• https://plugins.trac.wordpress.org/browser/quick-playground/tags/1.3.1/utility.php#L162 · Note
• https://plugins.trac.wordpress.org/browser/quick-playground/tags/1.3.1/api.php#L631 · Note
• https://plugins.trac.wordpress.org/browser/quick-playground/trunk/api.php#L62 · Note
• https://plugins.trac.wordpress.org/browser/quick-playground/trunk/utility.php#L162 · Note
• https://plugins.trac.wordpress.org/browser/quick-playground/tags/1.3.1/api.php#L62 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3523317%40quick-playground&new=3523317%40quick-playground&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3514238%40quick-playground&new=3514238%40quick-playground&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/quick-playground/trunk/utility.php#L248 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a39dccb6-b635-44af-b0e0-c3010b719773?source=cve · Note
• https://plugins.trac.wordpress.org/browser/quick-playground/tags/1.3.1/utility.php#L248 · Note