WP-FormAssembly <= 2.0.5 is vulnerable to Auth. Arbitrary File Read vulnerability

The WP-FormAssembly plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.0.5. This is due to insufficient controls on defining file paths on the fa_add() function. This makes it possible for contributor-level attackers to read the contents of any server file, including database configurations.