Vulnerability fixed in WordPress

WordPress developers have fixed a vulnerability that an unauthenticated attacker could exploit to include local PHP files outside the active theme directories.