ICS Calendar < 10.12.0.2 - Authenticated(Contributor+) Directory Traversal via _url_get_contents

Description

The ICS Calendar plugin for WordPress is vulnerable to Directory Traversal in all versions up, and including, 10.12.0.1 via the _url_get_contents function. This makes it possible for authenticated attackers, with contributor access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.