An exploit has been made publicly available affecting Wordpress PictPress <= release0.91 plugin.

This is a remote file include vulnerability. This means an attacker requires no authentication or action from the blog administrator in order to compromise or gain full access to the blog.

This is a CRITICAL risk issue. It is recommended that you disable this plugin if in use, until a fix has been provided by the plugin developer.

Credits to Gold_M for discovering this vulnerability.