The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets.Referenceshttps://joomdonation.com/joomla-extensions/membership-pro-joomla-membership-subscription.html
