WordPress allow-l10n-upload-filename plugin version 1.0 suffers from an arbitrary file download vulnerability.