Executive brief
The Quick Playground plugin for WordPress, which helps users test and clone sites, contains a security flaw that could allow an administrator to view sensitive files on the server. By exploiting this vulnerability, an attacker could access critical configuration files or system data, potentially leading to further compromise of the website or server environment. This issue only affects sites specifically configured to sync with the WordPress Playground service.
Technical details
A path traversal vulnerability exists in the Quick Playground plugin for WordPress due to insufficient input validation in the `qckply_data()` function. The function takes a user-supplied `filename` via a POST parameter and passes it directly to the PHP `file_get_contents()` function without sanitization or directory restriction. An authenticated attacker with Administrator-level privileges can exploit this to read sensitive files such as `wp-config.php` or `/etc/passwd`. Exploitation is limited to environments where the site is synced with WordPress Playground (indicated by the `is_qckply_clone` option) or is running on `playground.wordpress.net`.
Affected products
- WordPress Quick Playground <= 1.3.4
Timeline
- 2026-06-06: disclosed
- 2026-06-06: advisory
References
- https://plugins.trac.wordpress.org/browser/quick-playground/tags/1.2/client-qckply_data.php
- https://plugins.trac.wordpress.org/browser/quick-playground/trunk/client-qckply_data.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3558027%40quick-playground&new=3558027%40quick-playground&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a920d8c0-fb6b-40dc-ae61-ac004b0dfccd?source=cve