CVE-2026-2500

Description

The Quick Playground plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.4. This is due to the `qckply_data()` function passing the user-supplied `filename` POST parameter directly to `file_get_contents()` without any validation, sanitization, or path restriction. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the server, such as `wp-config.php` or `/etc/passwd`, which can contain sensitive information. Note: This vulnerability is only exploitable when the site has been synced with WordPress Playground (the `is_qckply_clone` option is set) or when running on `playground.wordpress.net`.

PUBLISHED Reserved 2026-02-13 | Published 2026-06-06 | Updated 2026-06-06 | Assigner Wordfence

Problem types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Timeline

Credits

Pablo Santiago finder

References

www.wordfence.com/...-fb6b-40dc-ae61-ac004b0dfccd?source=cve

plugins.trac.wordpress.org/...d/trunk/client-qckply_data.php

plugins.trac.wordpress.org/...ags/1.2/client-qckply_data.php

plugins.trac.wordpress.org/...ayground&sfp_email=&sfph_mail=

cve.org (CVE-2026-2500)

nvd.nist.gov (CVE-2026-2500)

Download JSON