Modula 2.13.1 - 2.13.2 - Author+ Arbitrary File Upload via Race Condition

Description

The plugin is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_unzip_file' function. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files with race condition on the affected site's server which may make remote code execution possible.