Input validation vulnerability in PHP to Page 0.3

The PHP to Page plugin for WordPress is vulnerable to a type of attack known as Local File Inclusion to Remote Code Execution. This type of attack is possible in versions of the plugin up to and including 0.3, using the ‘php-to-page’ shortcode. This means that any user who is authenticated and has at least subscriber-level permissions can include local files, which could potentially be used to execute code on the server. Subscribers may need to corrupt log files or install files in order to achieve Remote Code Execution, but users with author or higher permissions can upload files by default, making it much easier to perform this type of attack.