CVE-2026-2500mediumCWE-22

CVE-2026-2500: falha de média gravidade em davidfcarr Quick Playground

Quick Playground <= 1.3.4 - Authenticated (Administrator+) Arbitrary File Read via 'filename' Parameter

Publicada em

Seguir esta CVE+ Monitorar Quick Playground

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.4epss 0.3%
The Quick Playground plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.4. This is due to the `qckply_data()` function passing the user-supplied `filename` POST parameter directly to `file_get_contents()` without any validation, sanitization, or path restriction. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the server, such as `wp-config.php` or `/etc/passwd`, which can contain sensitive information. Note: This vulnerability is only exploitable when the site has been synced with WordPress Playground (the `is_qckply_clone` option is set) or when running on `playground.wordpress.net`.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
davidfcarr · Quick Playground
CVEs relacionadas — davidfcarr Quick Playground

No mesmo produto, das mais perigosas para as menos.

CVE-2026-1830CRITICALQuick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File UploadEPSS 8.1%CVE-2026-6403HIGHQuick Playground <= 1.3.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' ParameterEPSS 0.8%