WordPress Gallery Exporter <= 1.3 - Authenticated (Administrator+) Arbitrary File Download

Description The WordPress Gallery Exporter – Export your NextGen, Envira and FooGallery galleries to your computer plugin for WordPress is vulnerable to arbitrary file downloads in all versions up to, and including, 1.3. This is due to the plugin improperly validating the path to requested file downloads. This makes it possible for authenticated attackers, with administrator-level access and above, to download arbitrary files that may contain sensitive information such as wp-config.php