A non-authenticating WordPress Media Endpoint for Twitter Clients. It does NOT require O-Auth or Twitter developer keys.
Then that person can post images to your site. If you have done this by accident, then change your Secret URL to cut off access.
Because I'm not going to test it on older versions.