EKC Tournament Manager  < 2.2.2 - Local File Download Vulnerability
The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory