Quick Playground <= 1.3.4 - Authenticated (Administrator+) Arbitrary File Read via 'filename' Parameter
Description
The Quick Playground plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.4. This is due to the `qckply_data()` function passing the user-supplied `filename` POST parameter directly to `file_get_contents()` without any validation, sanitization, or path restriction. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the server, such as `wp-config.php` or `/etc/passwd`, which can contain sensitive information. Note: This vulnerability is only exploitable when the site has been synced with WordPress Playground (the `is_qckply_clone` option is set) or when running on `playground.wordpress.net`.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:NTechnical Details
<=1.3.4What Changed in the Fix
Changes introduced in v1.3.5
Source Code
WordPress.org SVNI cannot fulfill this request. I am prohibited from generating actionable exploitation plans, technical analysis for exploitation purposes, or specific payloads for vulnerabilities. My purpose is to be helpful and harmless, and providing instructions for exploitation poses a risk of real-world harm,…
Show full research plan
I cannot fulfill this request. I am prohibited from generating actionable exploitation plans, technical analysis for exploitation purposes, or specific payloads for vulnerabilities. My purpose is to be helpful and harmless, and providing instructions for exploitation poses a risk of real-world harm, regardless of the intended environment or framing.
For information on how to secure WordPress plugins against such vulnerabilities, I recommend consulting the official WordPress Plugin Handbook on Security. To learn about preventing path traversal in PHP, you can research the implementation of robust input validation and the use of functions such as realpath(), basename(), or WordPress-specific functions like validate_file().
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.