Zyrex Popup < 1.1 - Admin+ Arbitrary File Upload

Proof of Concept

Create a new popup by filling in anything in the title (Tytul) and link (Link) fields. 
Then select a php file as the image, and click "Dodaj popup" to add the popup.

The uploaded file can be accessed as http://example.com/wp-content/uploads/zyrex_popup/payload.php

By activating the popup (click the "Aktywuj" button), the payload will be loaded and executed whenever the popup is to be shown on the site.