preg_match() only check if $_GET['code'] contains at least one letter or digit (missing ^ and $ inside regexp).

Administrator privileges are NOT checked when we pass $_GET['wprss-bulk'].

Slashes are removed from $_GET['condition'].

$_GET['error_message'] is not escaped.

Anyone can access pulse/admin/inc/gal-sort.php.

By default .swf files in Media Manager are allowed.

Regular user (created using wp-login.php?action=register) can run backup functionality.

Link to created backup file is saved in public log.