WordPress Candidate Application Form <= 1.3 is susceptible to arbitrary file downloads because the code in downloadpdffile.php does not do any sanity checks.
Log in to view the POC file snapshot cached by Shenlong Bot
Log in to view