WordPress WP All Import Plugin <= 3.2.3 - Remote Code Execution

Because of this vulnerability, remote attackers can upload arbitrary files to system or retrieve any files on the system that ends in .txt or .html. Solution Update the plugin...