WPDating <= 7.4.1 - Arbitrary File Upload

The WPDating plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.4.1. This is due to missing file type validation on one of the plugin's functions. While the source of information claims that this is a cross-site request forgery vulnerability that requires tricking an administrative user to click a link in order to exploit the vulnerability, we believe that this may be exploitable by unauthenticated users as well after analyzing the provided proof of concepts. This makes it possible for unauthenticated attackers to upload malicious files to the server.