The WPB Show Core WordPress plugin through 2.2 is vulnerable to a local file inclusion via the `path` parameter.