CVE-2026-6403highCWE-22

CVE-2026-6403: falha de alta gravidade em davidfcarr Quick Playground

Quick Playground <= 1.3.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' Parameter

Publicada em

Seguir esta CVE+ Monitorar Quick Playground

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.8%
The Quick Playground plugin for WordPress is vulnerable to Path Traversal in versions up to and including 1.3.3. This is due to insufficient path validation in the qckply_zip_theme() function, which appends a user-controlled 'stylesheet' parameter directly to the theme root directory path without sanitizing directory traversal sequences. This makes it possible for unauthenticated attackers to trigger the creation of a ZIP archive containing arbitrary files from the server's filesystem — including wp-config.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
davidfcarr · Quick Playground
CVEs relacionadas — davidfcarr Quick Playground

No mesmo produto, das mais perigosas para as menos.

CVE-2026-1830CRITICALQuick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File UploadEPSS 8.1%CVE-2026-2500MEDIUMQuick Playground <= 1.3.4 - Authenticated (Administrator+) Arbitrary File Read via 'filename' ParameterEPSS 0.3%