CVE-2024-58348
WordPress Background Image Cropper version 1.2 has a critical flaw that lets anyone on the internet upload and run PHP files on the server. The vulnerability is triggered by sending a file to the ups.php endpoint. It can be exploited without any user interaction or special permissions.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress sites that have the Background Image Cropper plugin, version 1.2, installed.
Real-world impact
An attacker can upload malicious PHP code and then execute it on the web server, giving them full control over the site, the ability to steal data, deface pages, or use the server for further attacks.
Why this severity
The CVSS score of 9.3 reflects that the flaw is remotely exploitable (no authentication required), allows arbitrary code execution, and has a high impact on confidentiality, integrity, and availability. The vector shows no mitigations or user interaction are needed, making it a critical risk.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 8, 2026 · Jun 8, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.