Kacper Szurek has discovered a vulnerability in the DukaPress Plugin for Wordpress, which can be exploited by malicious people to disclose sensitive information.
Input passed via the "src" GET parameter to \lib\dp_image.php is not properly verified before being used to read files. This can be exploited to disclose the contents of arbitrary local files via directory traversal sequences.
The vulnerability is confirmed in version 2.5.3. Prior versions may be affected.
