Exploitation Summary
EIP tracks 2 public exploits for CVE-2025-8723. PoCs published by Nxploited, Boshe99.
AI-analyzed exploit summary This repository contains a functional Python exploit for CVE-2025-8723, targeting the Cloudflare Image Resizing WordPress plugin (versions <= 1.5.6). The exploit leverages a missing authentication vulnerability in the REST API endpoint to achieve unauthenticated remote code execution (RCE) via crafted JSON payloads.
Description
The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within its hook_rest_pre_dispatch() method in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to inject arbitrary PHP into the codebase, achieving remote code execution.
Exploits (2)
This repository contains a functional Python exploit for CVE-2025-8723, targeting the Cloudflare Image Resizing WordPress plugin (versions <= 1.5.6). The exploit leverages a missing authentication vulnerability in the REST API endpoint to achieve unauthenticated remote code execution (RCE) via crafted JSON payloads.
The repository contains functional exploit code for CVE-2025-8723, targeting an arbitrary file upload vulnerability in the WordPress Plugin 3DPrint Lite 1.9.1.4. The exploit demonstrates the ability to upload a malicious file to a vulnerable target.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H