CVE-2024-58348 CRITICAL

CVE-2024-58348: WordPress Background Image Cropper 1.2 Remote Code Execution

Vendor Background-Image-Cropper
Product Background Image Cropper
Weakness CWE-434 · Unrestricted file upload
Published June 8, 2026
Last update June 8, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

Description

WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to upload arbitrary files by accessing the ups.php endpoint. Attackers can upload PHP files through the file upload form in the plugin directory to execute arbitrary code on the server.

Key dates

Disclosure timeline

June 8, 2026 CVE published
June 8, 2026 Record updated