Upload plugin and theme functionalities do not check on PATHINFO_EXTENSION before upload.

[csorbamedia]

If you go to /wp-admin/plugins.php click the button Add new and you upload a .sql file or whatever file then this is possible. The fille end-up in the wp-uploads/ folder and will not be removed. There should which will check the extension and removes it if it is not a .zip file.