CVE-2024-58348: WordPress Background Image Cropper RCE

CVE-2024-58348 Overview

CVE-2024-58348 is an unauthenticated remote code execution vulnerability in the WordPress Background Image Cropper plugin version 1.2. The flaw resides in the ups.php endpoint, which accepts arbitrary file uploads without authentication or file-type validation. Attackers can upload PHP files through the plugin's upload form and execute arbitrary code on the underlying server. The issue is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). With no authentication required and a network-accessible attack surface, exploitation results in full compromise of the WordPress host.

Critical Impact

Unauthenticated attackers can upload and execute arbitrary PHP code on any WordPress site running Background Image Cropper 1.2, leading to complete server takeover.

Affected Products

• WordPress Background Image Cropper plugin version 1.2
• WordPress sites with the plugin installed and activated
• Any hosting environment serving the plugin's ups.php endpoint

Discovery Timeline

• 2026-06-08 - CVE-2024-58348 published to NVD
• 2026-06-08 - Last updated in NVD database

Technical Details for CVE-2024-58348

Vulnerability Analysis

The Background Image Cropper plugin exposes an upload handler at ups.php inside the plugin directory. The handler processes multipart form submissions and writes uploaded files directly to a web-accessible directory. The endpoint enforces no authentication, no nonce check, no MIME validation, and no file extension allowlist. As a result, an attacker can submit a PHP payload through the form and request the resulting URL to trigger execution under the web server user.

Exploitation produces full remote code execution on the WordPress host. From that position, attackers can read wp-config.php, exfiltrate database credentials, pivot to connected services, deploy webshells, or install persistent backdoors. The vulnerability is referenced in Exploit-DB #51998 and the VulnCheck advisory.

Root Cause

The root cause is unrestricted file upload [CWE-434]. The ups.php script trusts client-supplied filenames and content without verifying that the uploaded file is an image. The plugin also fails to enforce authentication or capability checks before accepting the upload, exposing the handler to anonymous internet traffic.

Attack Vector

An attacker sends an HTTP POST request containing a PHP file to /wp-content/plugins/background-image-cropper/ups.php. After the upload completes, the attacker requests the uploaded file directly through the browser. The web server interprets the file as PHP and executes its contents, returning the attacker's chosen command output. No credentials, user interaction, or chained vulnerabilities are required.

The vulnerability manifests in the upload handler's request processing logic. See the VulnCheck advisory and Exploit-DB #51998 for documented exploitation steps.

Detection Methods for CVE-2024-58348

Indicators of Compromise

• HTTP POST requests to /wp-content/plugins/background-image-cropper/ups.php from unauthenticated sources
• New .php, .phtml, or .phar files appearing in the plugin's upload directory
• Outbound connections from the web server process to attacker-controlled infrastructure following an upload event
• Web server access logs showing direct GET requests to recently uploaded PHP files in wp-content/plugins/background-image-cropper/

Detection Strategies

• Inspect web server access logs for POST requests targeting ups.php under the Background Image Cropper plugin path
• Hunt for PHP files with recent modification timestamps inside wp-content/plugins/ and wp-content/uploads/
• Correlate file creation events on the web root with subsequent HTTP GET requests to the same path
• Deploy WAF rules that block requests to ups.php containing PHP tags or executable file extensions in the multipart body

Monitoring Recommendations

• Enable file integrity monitoring on the WordPress document root, with alerts on writes to plugin directories
• Forward web server logs to a centralized analytics platform and alert on requests to known vulnerable endpoints
• Monitor PHP process creation for spawned shells, system(), exec(), or outbound network connections from www-data
• Track WordPress plugin inventory and flag installations of Background Image Cropper across managed sites

How to Mitigate CVE-2024-58348

Immediate Actions Required

• Deactivate and remove the Background Image Cropper plugin from all WordPress installations until a verified patch is available
• Search the web root for unauthorized PHP files created since the plugin was installed and remove confirmed webshells
• Rotate WordPress administrator passwords, database credentials in wp-config.php, and any API keys stored on the host
• Block external access to /wp-content/plugins/background-image-cropper/ups.php at the web server or WAF layer

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Review the WordPress plugin page for updates. Until a fixed release is published, removal of the plugin is the only reliable remediation.

Workarounds

• Remove the plugin directory from disk: rm -rf wp-content/plugins/background-image-cropper/
• Add a web server rule denying access to ups.php within the plugin path
• Disable PHP execution inside wp-content/uploads/ and any plugin upload directories using web server configuration
• Restrict write permissions on plugin directories to prevent attacker-controlled file persistence

# Nginx configuration example to block the vulnerable endpoint
location ~* /wp-content/plugins/background-image-cropper/ups\.php$ {
    deny all;
    return 403;
}

# Disable PHP execution in upload paths
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}