The webp-express plugin prior to 0.14.11 for WordPress has insufficient protection against arbitrary file reading.
webp express project webp express