WordPress DukaPress Plugin <=2.5.3 - Directory Traversal

This vulnerability is in the “dp_img_resize” function in php/dp-functions.php. It allows the attackers to read arbitrary files in the “src” parameter to lib/dp_image.php.

Solution

           Update the plugin.