The dzs-zoomsounds plugin up to and including 2.0 for WordPress has admin/upload.php arbitrary file upload.
digitalzoomstudio zoomsounds