CVE-2024-58348: WordPress Background Image Cropper 1.2 Remote Code Execution
WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to upload arbitrary files by accessing the ups.php endpoint. Attackers can upload PHP files through the file upload form in the plugin directory to execute arbitrary code on the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
wordpress/background-image-cropperfrom your environment.Uninstall or deactivate the Background Image Cropper plugin from the WordPress installation if it is not required.
- Configuration
Disable or remove the ups.php upload endpoint or disable the plugin's upload functionality to prevent unauthenticated file uploads.
Background Image Cropper plugin (ups.php upload endpoint) access = disabled - Compensating control
Block or restrict HTTP access to the plugin's upload endpoint (ups.php) using a web application firewall, web server access rules, or IP restrictions until the plugin is removed or a vendor fix is available.
- Operational
Search the plugin directory and web root for uploaded PHP files or web shells, remove any malicious files, restore affected files from known-good backups, review access logs for unauthorized activity, rotate any credentials that may have been exposed, and rebuild compromised hosts if full compromise is suspected.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58348?
CVE-2024-58348 has a critical severity rating of 9.8.
How do I fix CVE-2024-58348?
You should immediately update the WordPress Background Image Cropper plugin to the latest version to mitigate CVE-2024-58348.
What type of exploit does CVE-2024-58348 represent?
CVE-2024-58348 represents a remote code execution vulnerability due to malicious file uploads.
Who is affected by CVE-2024-58348?
Any WordPress site using version 1.2 of the Background Image Cropper plugin is at risk from CVE-2024-58348.
What can an attacker do with CVE-2024-58348?
An attacker can upload arbitrary PHP files through the ups.php endpoint, potentially leading to full server compromise.