Description The plugin exposes the full path of a file when putting in a non-existent file in a parameter of the shortcode.
1. Create a page 2. Place the shortcode [vrm360 canvas_name=s1 model_url=SA_Character.zip aspect_ratio=1.8 initial_offset=0.9]
on the page (SA_Character.zip
should be a non-existent file) 3. Publish page 4. Visit the page and see the full path disclosure in the browser’s console.