CVE-2025-8723: 
WordPress vulnerability analysis and mitigation

CVE-2025-8723 is a Remote Code Execution (RCE) vulnerability in the Cloudflare Image Resizing plugin for WordPress, affecting all versions up to and including 1.5.6. The flaw stems from missing authentication and insufficient input sanitization in the plugin's hook_rest_pre_dispatch() method, enabling unauthenticated attackers to inject arbitrary PHP code into the codebase. It was published on August 19, 2025, with a CVSS v3.1 base score of 9.8 (Critical) (Red Hat CVE, Vulners).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The vulnerable hook_rest_pre_dispatch() method in the plugin fails to authenticate incoming REST API requests and does not adequately sanitize user-supplied input, allowing an attacker to inject arbitrary PHP code directly into the WordPress codebase via a crafted network request. No privileges or user interaction are required, and attack complexity is low, making this trivially exploitable over the network. A public proof-of-concept exploit is available on GitHub (GitHub PoC, CIRCL Advisory).

Successful exploitation results in complete compromise of the affected WordPress installation — attackers gain full confidentiality, integrity, and availability impact. An unauthenticated attacker can execute arbitrary commands on the web server, install malware or backdoors, exfiltrate sensitive data (including database credentials and user information), modify or delete site content, and potentially pivot to other systems accessible from the compromised host (Red Hat CVE, Feedly Intelligence).

A proof-of-concept exploit was published on GitHub (https://github.com/Nxploited/CVE-2025-8723) shortly after disclosure, and the vulnerability was added to Qualys web application detection coverage in August 2025. As of available data, there is no confirmed evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.36%, though the public PoC availability and critical CVSS score elevate practical risk. The vulnerability was also referenced in a CISA vulnerability bulletin for the week of August 18, 2025 (CISA Bulletin, GitHub PoC, Qualys).

1. Reconnaissance: Identify WordPress sites running the Cloudflare Image Resizing plugin (versions ≤ 1.5.6) using tools like WPScan, Shodan, or by checking publicly accessible plugin metadata at /wp-content/plugins/cloudflare-image-resizing/.
2. Target the vulnerable REST API endpoint: Send a crafted HTTP request to the WordPress REST API endpoint handled by the plugin's hook_rest_pre_dispatch() method, which lacks authentication checks.
3. Inject malicious PHP payload: Include an unsanitized PHP code payload in the request parameters that the method processes without proper validation, causing the PHP code to be written into the plugin's codebase or a writable file on the server.
4. Achieve Remote Code Execution: Access the injected PHP file via the web server to trigger execution, establishing a web shell, reverse shell, or performing further malicious actions such as credential harvesting or lateral movement (GitHub PoC, Red Hat CVE).

• Network: Unusual or malformed HTTP POST/GET requests to WordPress REST API endpoints associated with the Cloudflare Image Resizing plugin; outbound connections from the web server to unknown external IPs following REST API activity.
• File System: Unexpected or newly created PHP files in /wp-content/plugins/cloudflare-image-resizing/ or other writable WordPress directories; web shells or obfuscated PHP scripts in the WordPress installation tree.
• Logs: WordPress and web server access logs showing repeated REST API requests with suspicious or encoded payloads targeting the plugin's endpoints; PHP error logs indicating code injection attempts or unexpected eval() execution.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget, python) not associated with normal WordPress operation (GitHub PoC).

Update the Cloudflare Image Resizing plugin to a version newer than 1.5.6 as soon as a patched release is available. If no patch is currently available, immediately disable or remove the plugin from the WordPress installation to eliminate the attack surface. As an additional layer of defense, implement web application firewall (WAF) rules to restrict or monitor REST API access to the affected plugin endpoints. Monitor WordPress and server logs for anomalous REST API activity and conduct integrity checks on plugin files (Red Hat CVE, CISA Bulletin).

The vulnerability was noted in a CISA weekly vulnerability bulletin for the week of August 18, 2025, and picked up by security aggregators including Vulners, VulDB, and CVEFeed shortly after disclosure. Check Point published a defense advisory (CPAI-2025-12172) covering this CVE. Community discussion was observed on Infosec.Exchange and security blogs such as tonyharris.io's PoC Week roundup. No major vendor statements beyond the CVE disclosure itself have been identified (CISA Bulletin, Check Point Advisory).