PT-2026-47235 · Background Image Cropper · Background Image Cropper

Milad Karimi · Published 2026-06-08 · Updated 2026-06-08 · CVE-2024-58348

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to upload arbitrary files by accessing the ups.php endpoint. Attackers can upload PHP files through the file upload form in the plugin directory to execute arbitrary code on the server.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-58348

Affected Products

Background Image Cropper

References · 5

• 🔥 https://exploit-db.com/exploits/51998 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-58348 · Security Note
• https://vulncheck.com/advisories/wordpress-background-image-cropper-remote-code-execution · Note
• https://wordpress.org · Note
• https://wordpress.org/plugins/background-image-cropper · Note