WordPress Smart Product Review plugin versions 1.0.4 and below suffer from a remote shell upload vulnerability.