Access violation vulnerability in BFG Tools – Extension Zipper 1.0.7

The BFG Tools – Extension Zipper plugin for WordPress has a security vulnerability that affects all versions up to and including 1.0.7. The issue is with how the plugin handles user input, specifically the `first_file` parameter in the `zip()` function. This vulnerability allows attackers with Administrator-level access or higher to access files and directories outside of the expected location, `/wp-content/plugins/`. This could potentially expose sensitive information like wp-config.php.