Cvefeed Critical Remote Code Execution Vulnerabilities in WordPress Plugins Identified
Article Content
- •Three critical RCE vulnerabilities disclosed for WordPress plugins on June 8, 2026.
- •CVE-2024-58348 allows unauthenticated file uploads via ups.php in Background Image Cropper.
- •No patches available; disabling affected plugins is recommended for mitigation.
On June 8, 2026, three critical remote code execution vulnerabilities were disclosed affecting WordPress plugins. CVE-2024-58348 in the Background Image Cropper plugin allows unauthenticated file uploads via the ups.php endpoint, enabling arbitrary code execution. CVE-2023-54350 in the Augmented-Reality plugin also permits file uploads through the elFinder connector, while CVE-2023-54352 in the Seotheme plugin allows PHP code execution via uploaded files in the theme directory. All vulnerabilities have a high CVSS score, indicating severe risk. Currently, no patches are available for CVE-2024-58348, and the other two vulnerabilities are also unpatched. Administrators are advised to disable the affected plugins to mitigate risks. There are no known exploits in the wild at this time.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (13)
Following this threat?
Track CVE-2023-54350 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to… 
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…