Critical vulnerability in Ninja Forms File Uploads premium add-on allows uploading arbitrary files without authentication, leading to remote code execution. The flaw is caused by lack of validation of file types/extensions on the destination filename. The function does not include any file type or extension checks on the destination filename before the move operation. No filename sanitization is utilized, facilitating path traversal and allowing files to be moved to the webroot directory. Attackers can upload arbitrary malicious PHP code and access the file to trigger remote code execution.