Paid Memberships Pro Plugin for WordPress contains a flaw that allows traversing outside of a restricted path. The issue is due to the /admin-ajax.php script not properly sanitizing user input, specifically path traversal style attacks (e.g. ‘../’) supplied via the ‘action’ parameter. With a specially crafted request, a remote attacker can gain access to arbitrary files.