Atomic Edge analysis of CVE-2026-2500:
This vulnerability allows an authenticated administrator to read arbitrary files from the server. The flaw exists in the Quick Playground plugin’s `qckply_data()` function, specifically in the `client-qckply_data.php` file. The vulnerability has a CVSS score of 4.4.
Root Cause: The `file_get_contents()` function in `client-qckply_data.php` (line 10 of the diff) directly uses the user-supplied `filename` POST parameter without any validation, sanitization, or path restriction. An attacker can supply an arbitrary file path (e.g., `../../wp-config.php`) as the `filename` parameter. The function then reads the contents of that file and returns them as a base64-encoded string. No checks ensure the path stays within the uploads directory or that it is a legitimate file.
Exploitation: An attacker with administrator privileges sends a POST request to the WordPress admin page at `/wp-admin/admin.php?page=qckply_data`. The request includes a `filename` POST parameter containing the path to the target file. For example, `filename=../../../../etc/passwd` or an absolute path. The response contains a `
` element with the base64-encoded contents of the file. The attacker can decode the base64 string to obtain the file contents in plaintext.
Patch Analysis: The patch adds multiple layers of validation. It uses `sanitize_file_name()` and `wp_unslash()` to normalize the input. It then resolves the absolute path using `realpath()` and checks that the resolved path starts with the WordPress uploads base directory (`$base_dir`). A successful read only occurs if the file exists (`is_file()`) and is readable (`is_readable()`). This ensures only files within the uploads directory can be accessed.
Impact: An attacker who exploits this vulnerability can read sensitive files from the server. This includes `wp-config.php` (which contains database credentials, salts, and secret keys), `/etc/passwd` (user account information), or any other file readable by the web server process. Such file disclosure can lead to complete compromise of the WordPress site, including database access and remote code execution via stolen credentials or secret keys.
