Description
WordPress Plugin Vitamin is prone to multiple arbitrary file disclosure vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to view local files in the context of the web server process, which may aid in launching further attacks. WordPress Plugin Vitamin version 1.0.0 is vulnerable.
Remediation
Update to plugin version 1.1.0 or latest
References
Related Vulnerabilities
WordPress Plugin WP Survey Plus Security Bypass (1.0)
WordPress Plugin SlideDeck 2 Lite Responsive Content Slider Local/Remote File Inclusion (2.3.3)
WordPress Plugin Viral Quiz Maker-OnionBuzz SQL Injection (1.2.1)
WordPress Plugin Apptivo Business Site CRM Multiple Cross-Site Scripting Vulnerabilities (1.2.9)
WordPress 2.0.5 Invalid CSRF Token Cross-Site Scripting Vulnerability (0.6.2 - 2.0.5)