What is the CVSS score of CVE-2026-2500?

CVE-2026-2500 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Quick Playground CVE-2026-2500

EUVD-2026-34953 MEDIUM

Path Traversal (CWE-22)

2026-06-06 Wordfence

GHSA-59q7-qrf3-gfx3

PHP Path Traversal WordPress

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 03:57 vuln.today

CVE Published

Jun 06, 2026 - 02:28 nvd

MEDIUM 4.4

DescriptionCVE.org

The Quick Playground plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.4. This is due to the qckply_data() function passing the user-supplied filename POST parameter directly to file_get_contents() without any validation, sanitization, or path restriction. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the server, such as wp-config.php or /etc/passwd, which can contain sensitive information. Note: This vulnerability is only exploitable when the site has been synced with WordPress Playground (the is_qckply_clone option is set) or when running on playground.wordpress.net.

AnalysisAI

Path traversal in the Quick Playground WordPress plugin (versions ≤ 1.3.4) exposes arbitrary server files to authenticated administrators. The flaw exists in client-qckply_data.php where the qckply_data() function forwards a user-supplied filename POST parameter directly into file_get_contents() without sanitization, enabling traversal sequences to escape the webroot and reach files such as wp-config.php or /etc/passwd. No public exploit exists and the vulnerability is not listed in the CISA KEV catalog, but exploitation would yield database credentials and other secrets with high confidentiality impact.

Technical ContextAI

The affected code, identified in client-qckply_data.php at line 10 (confirmed via WordPress plugin SVN browser for both trunk and the 1.2 tag), implements CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The PHP function file_get_contents() is a filesystem read primitive that will honor dot-dot-slash traversal sequences unless the caller explicitly normalizes or validates the input path. The plugin vendor is davidfcarr per CPE cpe:2.3:a:davidfcarr:quick_playground:*:*:*:*:*:*:*:*, confirming all versioned releases are in scope. The WordPress Playground sync feature (is_qckply_clone option) introduces the at-risk code path, meaning the flaw is only reachable when that integration is active.

RemediationAI

An upstream fix is available via WordPress plugin SVN changeset 3558027 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3558027%40quick-playground&new=3558027%40quick-playground); however, the exact patched plugin version number is not confirmed from the available input data - site operators should update Quick Playground to the latest available version in the WordPress plugin repository and verify the installed version exceeds 1.3.4. As a compensating control, disabling the WordPress Playground sync integration (ensuring the is_qckply_clone option is not set) eliminates the vulnerable code path entirely with no impact on standard WordPress functionality. Access to the wp-admin panel should be restricted by IP allowlist or HTTP authentication as a defense-in-depth measure, which also limits the Administrator-level access prerequisite this vulnerability requires.