Description
WordPress Plugin WP Custom Pages is prone to a local file disclosure vulnerability because it fails to adequately validate user-supplied input. Exploiting this vulnerability may allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks. WordPress Plugin WP Custom Pages versions 0.5.0.1 and prior are vulnerable.
Remediation
Edit the source code to ensure that input is properly sanitised or disable the plugin until a fix is available
References
http://www.securityfocus.com/bid/47146/exploit
http://www.exploit-db.com/exploits/17119/
http://packetstormsecurity.com/files/view/100047/WordPressWPCustomPages0.5.0.1-lfi.txt
Related Vulnerabilities
Jboss EAP Improper Handling of Exceptional Conditions Vulnerability (CVE-2018-8039)
WordPress Plugin WordPress Calls to Action Unspecified Vulnerability (2.3.1)
Ruby Resource Management Errors Vulnerability (CVE-2008-3656)
WordPress Plugin Import all XML, CSV & TXT into WordPress Cross-Site Scripting (6.4.2)