PT-2026-47126 · David F. Carr · Quick Playground

Pablo Santiago · Published 2026-06-06 · Updated 2026-06-06 · CVE-2026-2500

Mitre

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

The Quick Playground plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.4. This is due to the qckply data() function passing the user-supplied filename POST parameter directly to file get contents() without any validation, sanitization, or path restriction. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the server, such as wp-config.php or /etc/passwd, which can contain sensitive information. Note: This vulnerability is only exploitable when the site has been synced with WordPress Playground (the is qckply clone option is set) or when running on playground.wordpress.net.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-2500

Affected Products

Quick Playground

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-2500 · Security Note
• https://plugins.trac.wordpress.org/browser/quick-playground/trunk/client-qckply_data.php#L10 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3558027%40quick-playground&new=3558027%40quick-playground&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a920d8c0-fb6b-40dc-ae61-ac004b0dfccd?source=cve · Note
• https://plugins.trac.wordpress.org/browser/quick-playground/tags/1.2/client-qckply_data.php#L10 · Note