Possible file type issue

Well, without looking at the plug-in itself, I haven’t seen what source code you used to add the plug-in to wordpress, but if there is an admin panel or role setting, I would make it administrator or editor, so people registering, who are generally just subscribers, wouldn’t have access to the plug-in.

In general, low level users such as readers who register to make comments, such as subscribers only, should not have upload access to your site or be able to make blog posts. If they did, well, they they should have access to the default media uploader on blog posts and pages they add anyway, so limiting the role to higher level users, would in my mind, mitigate abuse by subscribers of a site, for people who leave registration open to the public on their WordPress sites. By default, registration is turned off, so a site owner would have to enable this. If it was a site that also used something like say, S2 Subscriber plug-in, to have access to paid for pages and posts, they generally only have read access to those pay for pages and posts or download content, but in general, don’t have access to make blog posts or pages. If however this plug-in shows up under their sign ons though, they could upload a reverse shell, and then root the site to deface it, read the wp-config.php file, inject a payload to overwrite the admins password in the data base with their own, and then login as the admin, change the admins email, etc.

So my suggestion, is make the plug-in available only to administrators or editor roles.

http://codex.wordpress.org/Roles_and_Capabilities#Administrator