The ad-inserter plugin prior to 2.4.20 for WordPress has path traversal.
ad inserter project ad inserter