Authenticated file upload via unchecked module import

Arbitrary file upload in WPMU DEV Hustle 7.8.9.2 and earlier allows remote authenticated users to write dangerous files to a WordPress server. The action_import_module() handler accepts uploaded module data without correctly enforcing file-type validation on the resulting files. Exploitation requires an administrator to grant module or edit permissions so the account can reach Hustle's admin page and obtain its nonce; executable uploads permit code execution when the server processes them.