CVE-2026-2500

Name of the Vulnerable Software and Affected Versions Quick Playground versions prior to 1.3.5

Description The Quick Playground plugin for WordPress contains a path traversal flaw. The qckply data() function processes the filename POST parameter and passes it to file get contents() without proper validation, sanitization, or path restrictions. This allows authenticated attackers with Administrator-level access or higher to read arbitrary files on the server, such as wp-config.php or /etc/passwd. This issue is exploitable only if the site is running on playground.wordpress.net or has been synced with WordPress Playground, indicated by the is qckply clone option being set.

Recommendations Update the plugin to a version later than 1.3.4. As a temporary mitigation, restrict access to the qckply data() function or ensure the is qckply clone option is disabled if not required.