Quick Playground
Monthly
Remote unauthenticated attackers can exploit a path traversal vulnerability in Quick Playground plugin for WordPress (versions ≤1.3.3) to exfiltrate sensitive server files including wp-config.php credentials. The flaw in the qckply_zip_theme() function allows arbitrary filesystem traversal via an unsanitized 'stylesheet' parameter, triggering creation of downloadable ZIP archives containing any server-accessible files. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicating trivial remote exploitation requiring no authentication, this represents an immediate confidentiality risk for all sites running affected versions, though no CISA KEV listing or public exploit code has been identified at time of analysis.
Remote code execution in Quick Playground plugin for WordPress (all versions through 1.3.1) allows unauthenticated attackers to execute arbitrary PHP code on the server. Vulnerability stems from insufficient authorization on REST API endpoints that expose a sync code and permit unrestricted file uploads. Attackers can retrieve the sync code via unsecured endpoints, upload malicious PHP files using path traversal techniques, and achieve full server compromise without authentication. CVSS 9.8 critical severity. No public exploit identified at time of analysis.
Path traversal in the Quick Playground WordPress plugin (versions ≤ 1.3.4) exposes arbitrary server files to authenticated administrators. The flaw exists in client-qckply_data.php where the qckply_data() function forwards a user-supplied filename POST parameter directly into file_get_contents() without sanitization, enabling traversal sequences to escape the webroot and reach files such as wp-config.php or /etc/passwd. No public exploit exists and the vulnerability is not listed in the CISA KEV catalog, but exploitation would yield database credentials and other secrets with high confidentiality impact.
Remote unauthenticated attackers can exploit a path traversal vulnerability in Quick Playground plugin for WordPress (versions ≤1.3.3) to exfiltrate sensitive server files including wp-config.php credentials. The flaw in the qckply_zip_theme() function allows arbitrary filesystem traversal via an unsanitized 'stylesheet' parameter, triggering creation of downloadable ZIP archives containing any server-accessible files. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicating trivial remote exploitation requiring no authentication, this represents an immediate confidentiality risk for all sites running affected versions, though no CISA KEV listing or public exploit code has been identified at time of analysis.
Remote code execution in Quick Playground plugin for WordPress (all versions through 1.3.1) allows unauthenticated attackers to execute arbitrary PHP code on the server. Vulnerability stems from insufficient authorization on REST API endpoints that expose a sync code and permit unrestricted file uploads. Attackers can retrieve the sync code via unsecured endpoints, upload malicious PHP files using path traversal techniques, and achieve full server compromise without authentication. CVSS 9.8 critical severity. No public exploit identified at time of analysis.
Path traversal in the Quick Playground WordPress plugin (versions ≤ 1.3.4) exposes arbitrary server files to authenticated administrators. The flaw exists in client-qckply_data.php where the qckply_data() function forwards a user-supplied filename POST parameter directly into file_get_contents() without sanitization, enabling traversal sequences to escape the webroot and reach files such as wp-config.php or /etc/passwd. No public exploit exists and the vulnerability is not listed in the CISA KEV catalog, but exploitation would yield database credentials and other secrets with high confidentiality impact.