CVE-2026-6403 is a path traversal vulnerability (CWE-22) in the Quick Playground WordPress plugin by davidfcarr, affecting versions up to and including 1.3.3. The vulnerability exists because the qckply_zip_theme() function appends a user-controlled 'stylesheet' parameter directly to the theme root directory path without sanitizing directory traversal characters. This allows unauthenticated attackers to cause the plugin to create ZIP archives containing arbitrary files from the server filesystem, potentially exposing sensitive configuration files such as wp-config.php. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high impact on confidentiality with no required privileges or user interaction.

An unauthenticated attacker can exploit this vulnerability to read arbitrary files on the server by triggering the creation of ZIP archives containing those files. This can lead to disclosure of sensitive information, including WordPress configuration files (e.g., wp-config.php), which may contain database credentials and other secrets. There is no indication of impact on integrity or availability. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Quick Playground plugin if possible to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.