WordPress sermon-shortcodes plugin version 1.0 suffers from an arbitrary file download vulnerability.