The users-ultra plugin prior to 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.
usersultra users ultra membership