What the vulnerability does
01Description
The Quick Playground plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.4. This is due to the `qckply_data()` function passing the user-supplied `filename` POST parameter directly to `file_get_contents()` without any validation, sanitization, or path restriction. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the server, such as `wp-config.php` or `/etc/passwd`, which can contain sensitive information. Note: This vulnerability is only exploitable when the site has been synced with WordPress Playground (the `is_qckply_clone` option is set) or when running on `playground.wordpress.net`.
Explanation of Vulnerability in Simple Terms
02Summary
Quick Playground versions up to 1.3.4 contain a path traversal vulnerability that allows high-privilege users to read arbitrary files from the server. An attacker with administrative access can bypass directory restrictions and access sensitive files outside the intended application directory. The vulnerability requires high attack complexity and administrative credentials to exploit.
What an attacker can do
03Attacker Capabilities
Read arbitrary files on the server outside the intended application directory.
Potential impact on your site
04Site Impact
Administrators with malicious intent or compromised admin accounts can access sensitive configuration files, database credentials, and other confidential data.
Conditions required to exploit
05Prerequisites
Attacker must have high-level administrative privileges and network access to the application.
Key dates
06Disclosure timeline
June 6, 2026
CVE published
June 6, 2026
Record updated
