CVE-2026-2500

The Quick Playground plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.4. This is due to the `qckply_data()` function passing the user-supplied `filename` POST parameter directly to `file_get_contents()` without any validation, sanitization, or path restriction. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the server, such as `wp-config.php` or `/etc/passwd`, which can contain sensitive information. Note: This vulnerability is only exploitable when the site has been synced with WordPress Playground (the `is_qckply_clone` option is set) or when running on `playground.wordpress.net`.

• CWE-22

• https://plugins.trac.wordpress.org/browser/quick-playground/tags/1.2/client-qckply_data.php#L10
• https://plugins.trac.wordpress.org/browser/quick-playground/trunk/client-qckply_data.php#L10
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3558027%40quick-playground&new=3558027%40quick-playground&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a920d8c0-fb6b-40dc-ae61-ac004b0dfccd?source=cve

Published

Jun 6, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24994Missing Authorization vulnerability in sunshinephotocart Sun…5.3
• CVE-2026-24995Missing Authorization vulnerability in Iulia Cazan Latest Po…4.3
• CVE-2026-24996Missing Authorization vulnerability in wpelemento WPElemento…4.3
• CVE-2026-24997Missing Authorization vulnerability in Wired Impact Wired Im…5.3
• CVE-2026-24998Exposure of Sensitive System Information to an Unauthorized …5.3
• CVE-2026-24999Missing Authorization vulnerability in Alma Alma alma-gatewa…5.3
• CVE-2026-25000Missing Authorization vulnerability in Kraft Plugins Wheel o…5.3
• CVE-2026-25001Improper Control of Generation of Code ('Code Injection') vu…8.5
• CVE-2026-25002Authentication Bypass Using an Alternate Path or Channel vul…7.5
• CVE-2026-25003Missing Authorization vulnerability in madalin.ungureanu Cli…4.3
• CVE-2026-25004Improper Neutralization of Input During Web Page Generation …5.9
• CVE-2026-25005Authorization Bypass Through User-Controlled Key vulnerabili…5.3