Product
The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize user-supplied file paths, allowing users with minimal permissions to read or delete arbitrary files on the server.