WordPress Background Image Cropper plugin version 1.2 suffers from a remote shell upload vulnerability.