CVE-2025-8723
Cloudflare Image Resizing <= 1.5.6 - Missing Authentication to Unauthenticated Remote Code Execution via rest_pre_dispatch Hook
CRITICAL 9.8EPSS 18.0%
The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within its hook_rest_pre_dispatch() method in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to inject arbitrary PHP into the codebase, achieving remote code execution.
- Affected
- mecanik · Cloudflare Image Resizing – Optimize & Accelerate Your Images
- CVSS v3.1 WORDFENCE
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 18.03% chance of exploitation in the next 30 days, 97th percentile
- Published
- 2025-08-19
- Updated
- 2026-04-08
Proof-of-concept exploits (1)
- Nxploited/CVE-2025-87237★ · 2025-08-19