Blog-in-Blog <= 1.1.1 - Editor+ Local File Inclusion via Shortcode

The plugin does not validate a shortcode attribute before using it to include a template file, allowing users with an editor role or above to include arbitrary files readable by the web server, and execute them in case of php files.