Path Traversal Vulnerability in Quick Playground Plugin for WordPress

CVE-2026-2500

What is CVE-2026-2500?

The Quick Playground plugin for WordPress is susceptible to a Path Traversal vulnerability, allowing authenticated users with Administrator-level access to exploit the qckply_data() function. By submitting malicious data via the filename parameter, attackers can bypass validation and access sensitive files on the server, such as configuration files (wp-config.php) or the system’s password files (/etc/passwd). This risk is compounded when sites are synced with WordPress Playground, enabling a potential breach of critical data.

References