Following JRASERVER-77129, uploading plugins is disabled by default. The "Upload an application" button, however, is still present on the "Versions & licenses" page, even if -Dupm.plugin.upload.enabled=true is not set. This is just a user experience nuisance and does not pose a security threat. The corresponding REST resource is correctly disabled, so the button in fact is inoperational. Its presence can, however, confuse admins and thus the button should be hidden.