What is the CVSS score of CVE-2026-6403?

CVE-2026-6403 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Quick Playground are affected by CVE-2026-6403?

The Quick Playground WordPress plugin (versions ≤1.3.3) contains a remote path traversal vulnerability enabling unauthenticated attackers to download sensitive server files, including database…

How to fix or mitigate CVE-2026-6403?

Within 24 hours: Disable and deactivate Quick Playground plugin on all WordPress installations; audit web server logs for suspicious zip file requests to the plugin directory. Within 7 days: Identify all sites running Quick Playground ≤1.3.3; if no alternative plugin exists, develop compensating controls (see below) or migrate to alternative theme management solutions. Within 30 days: Once patch is released, update to patched version and conduct credential rotation for all database users and API keys exposed in wp-config.php.

Quick Playground CVE-2026-6403

EUVD-2026-30517 HIGH

Path Traversal (CWE-22)

2026-05-15 Wordfence

GHSA-5vxp-83xg-5c9f

WordPress Path Traversal

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 09:31 vuln.today

CVE Published

May 15, 2026 - 07:46 nvd

HIGH 7.5

DescriptionCVE.org

The Quick Playground plugin for WordPress is vulnerable to Path Traversal in versions up to and including 1.3.3. This is due to insufficient path validation in the qckply_zip_theme() function, which appends a user-controlled 'stylesheet' parameter directly to the theme root directory path without sanitizing directory traversal sequences. This makes it possible for unauthenticated attackers to trigger the creation of a ZIP archive containing arbitrary files from the server's filesystem - including wp-config.

AnalysisAI

Remote unauthenticated attackers can exploit a path traversal vulnerability in Quick Playground plugin for WordPress (versions ≤1.3.3) to exfiltrate sensitive server files including wp-config.php credentials. The flaw in the qckply_zip_theme() function allows arbitrary filesystem traversal via an unsanitized 'stylesheet' parameter, triggering creation of downloadable ZIP archives containing any server-accessible files. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicating trivial remote exploitation requiring no authentication, this represents an immediate confidentiality risk for all sites running affected versions, though no CISA KEV listing or public exploit code has been identified at time of analysis.

Technical ContextAI

This vulnerability stems from insufficient input validation in WordPress plugin code handling filesystem operations. The Quick Playground plugin's qckply_zip_theme() function directly concatenates user-supplied 'stylesheet' parameter values to the WordPress theme directory path without sanitizing directory traversal sequences like '../'. This CWE-22 Path Traversal weakness allows attackers to escape the intended theme directory scope and reference arbitrary files on the server filesystem. The vulnerable code paths are visible in utility.php (lines 162, 248) and api.php (lines 62, 631) in versions through 1.3.3. WordPress plugins running with web server privileges can typically read configuration files, making wp-config.php (containing database credentials and security keys) a prime target. The affected product is identified by CPE cpe:2.3:a:davidfcarr:quick_playground:*:*:*:*:*:*:*:*, developed by davidfcarr and distributed through the official WordPress plugin repository.

RemediationAI

WordPress administrators should immediately update Quick Playground plugin to version 1.3.4 or later, which addresses the path traversal vulnerability through proper input sanitization in the qckply_zip_theme() function per WordPress plugin repository changeset 3523317. Update via WordPress admin dashboard (Plugins → Installed Plugins → Quick Playground → Update Now) or manually download from official WordPress plugin repository. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: (1) Deactivate and delete Quick Playground plugin entirely until patched version can be deployed - eliminates attack surface but removes plugin functionality; (2) Implement web application firewall (WAF) rules blocking requests containing '../' or URL-encoded traversal sequences ('%2e%2e%2f') in 'stylesheet' parameter - may cause false positives with legitimate theme names containing dots; (3) Restrict WordPress plugin directory permissions to prevent web server read access to wp-config.php using filesystem ACLs - may break legitimate WordPress functionality requiring configuration file access. Review web server access logs for suspicious requests to Quick Playground endpoints (api.php, utility.php) with unusual 'stylesheet' parameter values. Post-patching, rotate WordPress database credentials and security salts in wp-config.php if exploitation is suspected. Advisory and patch details: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3523317%40quick-playground&new=3523317%40quick-playground.