The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within its hook_rest_pre_dispatch() method in all versions up to, and including, 1.5.6. This vulnerability allows unauthenticated attackers to inject arbitrary PHP code into the codebase, leading to remote code execution.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2025-8723 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted requests to the vulnerable plugin’s endpoint, allowing them to execute arbitrary PHP code on the server without any authentication. This can lead to full control over the affected WordPress site.
Affected Products
- Cloudflare Image Resizing plugin (versions up to 1.5.6): This plugin allows users to resize images on their WordPress site but is vulnerable to remote code execution due to insufficient security measures.
Mitigation
To mitigate this vulnerability, users should update the Cloudflare Image Resizing plugin to the latest version where the issue has been addressed. Additionally, implementing proper security measures such as authentication and input sanitization can help prevent similar vulnerabilities in the future.