Cloudflare Image Resizing <= 1.5.6 - Absence d'authentification menant à une exécution de code à distance non authentifiée via le Hook rest_pre_dispatch

The impact of CVE-2025-8723 is severe. Successful exploitation allows an attacker to execute arbitrary PHP code on the server hosting the WordPress site. This can lead to complete website takeover, data exfiltration (including sensitive user data, database credentials, and proprietary information), defacement, and the installation of malware. Given the plugin's function of image resizing, attackers could potentially leverage this to inject malicious code into images served to users, leading to further compromise. The lack of authentication makes this vulnerability particularly dangerous, as it can be exploited without any prior credentials.

WordPress websites utilizing the Cloudflare Image Resizing plugin, particularly those running versions 1.0.0 through 1.5.6, are at significant risk. Shared hosting environments where plugin updates are not managed by the website owner are especially vulnerable. Sites relying on this plugin for critical image processing or serving are also at higher risk.

• wordpress / composer / npm:

grep -r 'hook_rest_pre_dispatch()' /var/www/html/wp-content/plugins/cloudflare-image-resizing/

• wordpress / composer / npm:

wp plugin list | grep 'cloudflare-image-resizing'

• wordpress / composer / npm:

wp plugin update cloudflare-image-resizing --version=1.5.7

1. 2025-08-19Disclosure

   disclosure

1. Réservé2025-08-07
2. Publiée2025-08-19
3. Modifiée2026-04-08
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-8723 is to immediately upgrade the Cloudflare Image Resizing plugin to version 1.5.7 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin to prevent exploitation. While a direct WAF rule is difficult to implement without specific payload signatures, a general rule blocking requests to the hookrestpre_dispatch() endpoint could offer limited protection. Regularly review WordPress plugin installations and ensure they are from trusted sources.