Vrm 360 3D Model Viewer <= 1.2.1 - Full Path Disclosure

Description The plugin exposes the full path of a file when putting in a non-existent file in a parameter of the shortcode.

PoC

1. Create a page 2. Place the shortcode [vrm360 canvas_name=s1 model_url=SA_Character.zip aspect_ratio=1.8 initial_offset=0.9] on the page (SA_Character.zip should be a non-existent file) 3. Publish page 4. Visit the page and see the full path disclosure in the browser’s console.