CVE-2024-58348Disclosure

HIGHCVSS 9.3 · CRITICAL

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to upload arbitrary files by accessing the ups.php endpoint. Attackers can upload PHP files through the file upload form in the plugin directory to execute arbitrary code on the server.

Back to dashboard

7.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-434

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
5 mentions across 3 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 5 signals
Disclosure: 3 classified signals
Peaked 2d ago at 3 mentions (2026-06-08); latest day: 1
5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d

Signal classification3 categories

Disclosure

360.0%

Patch

120.0%

PoC

120.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-08	3	Disclosure3
2026-06-10	1	Patch1
2026-06-13	1	PoC1

Full discourse5 posts

SecAlerts@SecAlertsCo131d
PoC
🔓 Unauthenticated RCE in WordPress Background Image Cropper 1.2 — attackers can upload arbitrary files via ups.php with no login required. PoC is on Exploit-DB. CVE-2024-58348 https://secalerts.co/vulnerability/CVE-2024-58348 https://t.co/xmcEcqaU4U
Post summary
An unauthenticated remote code execution vulnerability in WordPress Background Image Cropper 1.2 allows attackers to upload arbitrary files via ups.php; a PoC is available on Exploit‑DB.
0000092
835 followersView on X
DFIR Lab@DFIR_Lab134d
Patch
🚨 CRITICAL: CVE-2024-58348 (CVSS 9.8) WordPress Background Image Cropper 1.2 allows unauthenticated RCE via arbitrary file upload. Attackers exploit ups[.]php endpoint to upload malicious PHP files. Patch immediately! #CVE #PatchNow #ThreatIntel https://t.co/tgnaPS1Vob
Post summary
The tweet announces the critical CVE-2024-58348 in WordPress Background Image Cropper, highlights active exploitation via file upload, and urges immediate patching.
0000045
43 followersView on X
Infoflowcloud@infoflowcloud136d
Disclosure
🚨*CVE* CVE-2024-58348 WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to upload arbitrary files by acces… https://www.cve.org/CVERecord?id=CVE-2024-58348 ----- Traducción: CVE-2024-58348 Wor… http://infoflow.cloud`
Post summary
The tweet announces CVE-2024-58348, noting a remote‑code‑execution flaw in WordPress Background Image Cropper 1.2 that permits unauthenticated file uploads, but provides no PoC, exploit, or mitigation details.
0000024
79 followersView on X
CVE@CVEnew136d
Disclosure
CVE-2024-58348 WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to upload arbitrary files by acces… https://www.cve.org/CVERecord?id=CVE-2024-58348
Post summary
The passage announces a remote code execution flaw in WordPress Background Image Cropper v1.2 that allows unauthenticated file uploads, but does not provide evidence of exploitation, a PoC, or a fix.
00000162
57.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds136d
Disclosure
CVE-2024-58348 Remote Code Execution in WordPress Background Image Cropper 1.2 via Arbi... https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-58348 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The post announces CVE-2024-58348 as a remote code execution flaw in WordPress Background Image Cropper 1.2, links to vulnerability detail pages, but does not provide a PoC, exploit code, patch, or evidence of active exploitation.
0000041
4.0K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2024-58348

DFIR Lab[verified]@DFIR_LabPatch

The tweet announces the critical CVE-2024-58348 in WordPress Background Image Cropper, highlights active exploitation via file upload, and urges immediate patching.

SecAlerts@SecAlertsCoPoC

An unauthenticated remote code execution vulnerability in WordPress Background Image Cropper 1.2 allows attackers to upload arbitrary files via ups.php; a PoC is available on Exploit‑DB.

Infoflowcloud@infoflowcloudDisclosure

The tweet announces CVE-2024-58348, noting a remote‑code‑execution flaw in WordPress Background Image Cropper 1.2 that permits unauthenticated file uploads, but provides no PoC, exploit, or mitigation details.

CVE@CVEnewDisclosure

The passage announces a remote code execution flaw in WordPress Background Image Cropper v1.2 that allows unauthenticated file uploads, but does not provide evidence of exploitation, a PoC, or a fix.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces CVE-2024-58348 as a remote code execution flaw in WordPress Background Image Cropper 1.2, links to vulnerability detail pages, but does not provide a PoC, exploit code, patch, or evidence of active exploitation.