Vendor
WooThemes Diarise versions through 1.5.9 are vulnerable to an arbitrary file read exploit in download.php, allowing unauthenticated attackers to retrieve sensitive system files via a crafted calendar parameter.