Its a very nice find, but not easy to call as attacker as can be read at the wordfence site. I agree it should have been better checked in code, however webhosters are also in charge of denying php calls to the uploads folder IMHO.