CVE-2026-6403
Quick Playground <= 1.3.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' Parameter
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
The Quick Playground plugin for WordPress is vulnerable to Path Traversal in versions up to and including 1.3.3. This is due to insufficient path validation in the qckply_zip_theme() function, which appends a user-controlled 'stylesheet' parameter directly to the theme root directory path without sanitizing directory traversal sequences. This makes it possible for unauthenticated attackers to trigger the creation of a ZIP archive containing arbitrary files from the server's filesystem — including wp-config.
| CWE | CWE-22 |
| Vendor | davidfcarr |
| Product | quick playground |
| Published | May 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for davidfcarr quick playground
Be the first to know when new high vulnerabilities affecting davidfcarr quick playground are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
davidfcarr / Quick Playground
0 ≤ 1.3.3
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/a39dccb6-b635-44af-b0e0-c3010b719773?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/quick-playground/trunk/utility.php#L162 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/quick-playground/tags/1.3.1/utility.php#L162 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/quick-playground/trunk/api.php#L62 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/quick-playground/tags/1.3.1/api.php#L62 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/quick-playground/trunk/utility.php#L248 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/quick-playground/tags/1.3.1/utility.php#L248 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/quick-playground/trunk/api.php#L631 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/quick-playground/tags/1.3.1/api.php#L631 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3523317%40quick-playground&new=3523317%40quick-playground&sfp_email=&sfph_mail= plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3514238%40quick-playground&new=3514238%40quick-playground&sfp_email=&sfph_mail=
Credits
Athiwat Tiprasaharn Itthidej Aramsri