Role Based Pricing for WooCommerce < 1.6.2 - Subscriber+ Arbitrary File Upload

The plugin does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any authenticated users like subscriber to upload arbitrary files, such as PHP

PoC

As a subscriber, open the HTML code below while being logged in as a subscriber, then choose a file to upload and submit it The file will be uploaded at https://example.com/wp-content/uploads/addify-role-pricing/ and have the same name than the original (path can also be found in the upload response). Path traversal vector could also be used to upload the file anywhere