A path traversal vulnerability in the WordPress Quick Playground plugin allows unauthenticated attackers to access arbitrary files on the hosting server.

The plugin fails to properly sanitize user-supplied input, leading to an improper limitation of a pathname to a restricted directory (CWE-22). This allows an unauthenticated attacker to traverse the directory structure and read sensitive system files.

This vulnerability carries a CVSS score of 7.5, indicating a high severity risk. Successful exploitation grants attackers unauthorized access to sensitive information stored on the server, such as configuration files, environment variables, or other application data, which could lead to full system compromise.

Immediate Action: Update the Quick Playground plugin to version 1.3.4 or higher immediately.

Proactive Monitoring: Inspect server access logs for requests containing directory traversal patterns (e.g., "../") targeting the plugin's API or utility endpoints.

Compensating Controls: Utilize a Web Application Firewall (WAF) with rules configured to block path traversal attempts and sanitize input parameters before they reach the application layer.

Public Exploit Available: false

The severity of this path traversal vulnerability necessitates immediate action. Administrators must update the Quick Playground plugin to the latest version to prevent unauthorized file access and potential data exfiltration.