CVE-2025-8723 Code injection in Cloudflare Image Resizing – Optimize & Accelerate Your Images
Unauthenticated attackers can achieve remote code execution in the Cloudflare Image Resizing WordPress plugin due to missing authentication and insufficient sanitization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-8723?
CVE-2025-8723 is a critical code injection vulnerability in mecanik Cloudflare Image Resizing – Optimize & Accelerate Your Images, published on 19 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within its hook_rest_pre_dispatch() method in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to inject arbitrary PHP into the codebase, achieving remote code execution.
Weakness: CWE-94
Which versions are affected by CVE-2025-8723?
How do I fix CVE-2025-8723?
No fix has been published for CVE-2025-8723 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-8723 being exploited?
There is no known exploitation of CVE-2025-8723 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-52w9-qfc2-5xq5.