The Quick Playground WordPress plugin allows authenticated users with Administrator-level permissions to supply a filename parameter that is directly passed to file_get_contents() without validation. This results in path traversal, enabling attackers to read any file on the server, including sensitive configuration files such as wp-config.php or system files like /etc/passwd. The flaw does not provide a privilege escalation beyond the existing administrator rights but exposes confidential data that can be leveraged for further attacks.

All installations of the Quick Playground plugin version 1.3.4 or earlier on WordPress sites are impacted. The vulnerability is exploitable only when the site has the WordPress Playground sync enabled (the is_qckply_clone option is set) or when the site is hosted on playground.wordpress.net. The affected product is the Quick Playground plugin for WordPress maintained by davidfcarr.

The CVSS score of 4.4 indicates moderate severity, and the EPSS score is not available, so the current probability of exploitation is uncertain. Because the flaw requires administrator access, the attack surface is limited to sites where an attacker can gain such privileges. The vulnerability is not listed in the CISA KEV catalog, suggesting no public exploit is known at this time. However, once an attacker obtains admin rights, file disclosure can lead to credential theft, code injection or further compromise.