Background Image Cropper <= 1.2 - Unauthenticated Remote Code Execution
criticalThe Background Image Cropper plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to execute code on the server.
- CVSS:
- 9.8
- Affected:
- up to 1.2
- Fix:
- No patched version reported
- Disclosed:
- Jun 7, 2026