The Directorist WordPress plugin prior to 7.5.4 is vulnerable to Local File Inclusion as it does not validate the file parameter when importing CSV files.
wpwax directorist