CVE-2025-8723
Published: 19 August 2025
Summary
CVE-2025-8723 is a critical-severity Code Injection (CWE-94) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
The Cloudflare Image Resizing plugin for WordPress is affected by a remote code execution vulnerability in all versions through 1.5.6. The flaw stems from missing authentication combined with insufficient input sanitization in the hook_rest_pre_dispatch() method, which permits injection of arbitrary PHP code into the application. The issue carries a CVSS 3.1 base score of 9.8 and is tracked under CWE-94.
Unauthenticated attackers with network access can invoke the vulnerable REST handler to write and execute malicious PHP, resulting in full compromise of the WordPress installation including the ability to read, modify, or delete data and potentially pivot within the hosting environment.
Public references include WordPress plugin repository changesets and Wordfence threat intelligence entries that document the availability of patched versions addressing the authentication and sanitization deficiencies.
EPSS remains low and unchanged at 0.0175 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28804
Vulnerability details
The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within its hook_rest_pre_dispatch() method in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to…
more
inject arbitrary PHP into the codebase, achieving remote code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated RCE via missing auth/sanitization in public-facing WordPress plugin (CWE-94).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of the code injection flaw by applying patches from changesets 3337593 and 3341917 to plugin versions beyond 1.5.6, directly eliminating the vulnerability.
Mandates validation and sanitization of inputs to the hook_rest_pre_dispatch() method, preventing arbitrary PHP code injection even in unpatched versions.
Enforces authentication and access controls on the unauthenticated REST endpoint, blocking unauthenticated attackers from reaching the vulnerable hook_rest_pre_dispatch() method.