A critical flaw uncovered In WordPress, please update now!

[Skyon Archer]

If the plugin processes it's own uploads then yes; however, as the article indicated, there are specific authentication steps that must be completed for this to happen.

This is one of the reasons that I recommend to NOT use plugins to all my WordPress hosting clients; excluding those that are actively maintained by trusted sources (i.e. contact form 7, jetpack, etc).