The wp-support-plus-responsive-ticket-system plugin prior to 4.2 for WordPress has directory traversal.
wpsupportplus wp support plus responsive ticket system