Input validation vulnerability in Shortcodes and extra features for Phlox theme 2.14.0

The Phlox theme plugin for WordPress is vulnerable to a security issue called Local File Inclusion in all versions up to and including version 2.14.0. This security issue makes it possible for unauthenticated attackers to include and execute arbitrary files on the server. This can allow the execution of any type of code, such as PHP code, that is present in the included files. This could be used to bypass access controls, gain access to sensitive data, or execute code when images and other “safe” file types can be uploaded and included.