WordPress WP GPX Maps Plugin 1.1.21 allows remote malicious users to execute arbitrary PHP code via improper file upload.
devfarm wp gpx maps 1.1.21