CVE-2025-66104: 
WordPress vulnerability analysis and mitigation

CVE-2025-66104 is a Missing Authorization vulnerability in the WordPress plugin "Offload, AI & Optimize with Cloudflare Images" (cf-images) by Anton Vanyukov, classified under CWE-862. It allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels. The vulnerability affects all versions of the plugin from n/a through 1.9.5. It was published on December 18, 2025, and carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Patchstack).

The root cause is a Missing Authorization flaw (CWE-862), where the plugin fails to properly verify that a requesting user has the appropriate permissions before executing sensitive operations. This allows a low-privileged authenticated user (e.g., a subscriber or contributor) to trigger actions that should be restricted to administrators. The attack vector is network-based, requires low privileges, no user interaction, and has low attack complexity, making it straightforward to exploit once an attacker has any valid WordPress account (Feedly).

Successful exploitation results in a high availability impact, meaning an attacker can disrupt or deny access to plugin-managed functionality — potentially affecting image offloading and optimization services powered by Cloudflare Images. There is no confidentiality or integrity impact identified in the CVSS scoring. The scope is limited to the affected WordPress installation, with no lateral movement potential beyond the plugin's operational context (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-66104 as of the available data. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

Users should update the "Offload, AI & Optimize with Cloudflare Images" (cf-images) WordPress plugin to a version beyond 1.9.5 that includes the authorization fix. Until a patched version is available or applied, administrators should restrict plugin access to trusted users only and consider temporarily deactivating the plugin if low-privileged untrusted accounts exist on the site. Monitoring WordPress user activity logs for unexpected plugin interactions by non-admin accounts is also advisable (Patchstack).