CVE-2024-58348
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
The WordPress Background Image Cropper plugin version 1.2 contains a remote code execution vulnerability, allowing unauthenticated attackers to upload arbitrary files via the ups.php endpoint. Attackers can upload PHP files and execute code on the server.
Risk Assessment
An attacker can gain full control of the WordPress server by uploading malicious files and executing arbitrary code.
Recommendation
Immediately remove or deactivate the Background Image Cropper plugin and scan the server for malicious files.
Original NVD description (English source)
WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to upload arbitrary files by accessing the ups.php endpoint. Attackers can upload PHP files through the file upload form in the plugin directory to execute arbitrary code on the server.