CVE-2025-8723: critical vulnerability in mecanik Cloudflare Image Resizing – Optimize &…
Cloudflare Image Resizing <= 1.5.6 - Missing Authentication to Unauthenticated Remote Code Execution via rest_pre_dispatch Hook
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
53Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.8epss 18%
from disclosure to weaponsame day
Published on NVDAug 19
1st PoCAug 19
The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within its hook_rest_pre_dispatch() method in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to inject arbitrary PHP into the codebase, achieving remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
public PoCs found — 1
githubgithub.com/Nxploited/CVE-2025-8723★ 8⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.