Contributor file upload via remote image fetch

Arbitrary file upload in Sync Post With Other Site through 1.9.3 allows remote authenticated users to write files via crafted sync requests. In includes/sps_sync.class.php, the public /sps/v1/data REST route accepts any caller, and sps_get_request authorizes any account with edit_posts before sps_add_update_post and spsp_grab_content_images fetch attacker-supplied featured_image and img src URLs with wp_remote_request and write the response body into wp_upload_dir() with fopen before type checks. A Contributor account is sufficient because that WordPress role has edit_posts; if the uploads path executes PHP, the write primitive yields code execution, otherwise it still places attacker-chosen files in web-accessible storage.