Product Input Fields for WooCommerce < 2.0 - Contributor+ Arbitrary File Read

Description

The plugin is vulnerable to Directory Traversal via the handle_downloads() function due to insufficient file path validation/sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.