The Hustle (aka wordpress-popup) plugin up to and including 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/admin/dashboard/ URI.
incsub hustle