The cysteme-finder plugin prior to 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.
cysteme cysteme-finder