Executive brief
The Background Image Cropper plugin for WordPress contains a critical security flaw that allows anyone to upload files to a website without logging in. By exploiting this, an attacker can upload malicious scripts to take full control of the website, steal data, or disrupt services. The plugin has been permanently closed and removed from the official WordPress directory due to these security concerns.
Technical details
A remote code execution (RCE) vulnerability exists in the WordPress Background Image Cropper plugin (v1.2) due to unrestricted file upload capabilities in the 'ups.php' component. The 'ups.php' endpoint fails to implement authentication or file-type validation, allowing an unauthenticated remote attacker to upload arbitrary PHP files directly to the plugin directory. Once uploaded, these files can be executed by the server, leading to full system compromise. The plugin was permanently closed by the WordPress Plugin Directory in June 2025 following reports of malicious activity and this vulnerability. An exploit script is publicly available (EDB-51998).
Affected products
- WordPress Background Image Cropper 1.2
Timeline
- 2024-04-21: disclosed: Exploit published on Exploit-DB
- 2025-06-25: other: Plugin permanently closed in WordPress directory at author request
- 2026-06-08: advisory: CVE published and NVD record created