Frontend File Manager < 18.3 - Authenticated Arbitrary Settings Change to Arbitrary File Upload

Description

The wpfm_save_settings AJAX action of the plugin, available to any authenticated user, was lacking CSRF and capability check, allowing any authenticated user to change the settings, and add PHP to the allowed filetype to be uploaded, which would then allow them to upload a malicious PHP file via the wpfm_upload_file AJAX action