CVE-2024-58348
CRITICALWordPress Background Image Cropper 1.2 Remote Code Execution
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2024-58348. PoCs published by Milad karimi.
AI-analyzed exploit summary This exploit targets a file upload vulnerability in the WordPress Background Image Cropper plugin v1.2, allowing unauthenticated remote code execution by uploading a malicious PHP shell. The script checks for the presence of the vulnerable endpoint and attempts to exploit it.
Description
WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to upload arbitrary files by accessing the ups.php endpoint. Attackers can upload PHP files through the file upload form in the plugin directory to execute arbitrary code on the server.
Exploits (1)
This exploit targets a file upload vulnerability in the WordPress Background Image Cropper plugin v1.2, allowing unauthenticated remote code execution by uploading a malicious PHP shell. The script checks for the presence of the vulnerable endpoint and attempts to exploit it.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H