WordPress Background Image Cropper version 1.2 contains a remote code execution flaw that lets an attacker upload any file type through the ups.php endpoint. The vulnerability enables the upload of PHP scripts which the web server then executes, providing full control over the site. This weakness falls under CWE‑434, Unrestricted Upload of File With Dangerous Type, and allows attackers to compromise the integrity and confidentiality of the affected server without authentication.

The flaw affects the Background Image Cropper plugin for WordPress, specifically version 1.2. No additional vendor or version information is available.

With a CVSS score of 9.3 the vulnerability is considered critical. The EPSS score is not provided, and the flaw is not listed in CISA’s KEV catalog, but the combination of unauthenticated access and the ability to execute code makes it highly exploitable. Attackers can directly target the plugin’s ups.php upload form to submit malicious PHP files and gain remote command execution on the host.