CVE-2024-58348

CRITICAL 9.3 CVSS 4.0

Published: June 8, 2026
Last modified: July 23, 2026
NVD status: Deferred
Reported by: disclosure@vulncheck.com
Weakness: CWE-434
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to upload arbitrary files by accessing the ups.php endpoint. Attackers can upload PHP files through the file upload form in the plugin directory to execute arbitrary code on the server.

Affected WordPress components

background-image-cropper Plugin · background-image-cropper

Confirmed match Homeless

Version 1.2
View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

background-image-cropper Background Image Cropper — Version 1.2

References

wordpress.org https://wordpress.org
wordpress.org https://wordpress.org/plugins/background-image-cropper/
www.exploit-db.com https://www.exploit-db.com/exploits/51998
www.vulncheck.com https://www.vulncheck.com/advisories/wordpress-background-image-cropper-remote-code-execution
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected WordPress components

Affected products and versions

References