WordPress Security in WordPress - Sanitization Sanitize file name
Example
$incfile = sanitize_file_name($_REQUEST["file"]);
include($incfile . ".php");
Without sanitizing the file name an attacker could simple pass http://attacker_site/malicous_page as input and execute whatever code in your server.
