Cloudflare Image Resizing WordPress Plugin Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the Cloudflare Image Resizing plugin for WordPress, affecting all versions through 1.5.6. The issue arises from missing authentication and inadequate input sanitization in the hook_rest_pre_dispatch() method, allowing unauthenticated attackers to inject arbitrary PHP code into the plugin, which could then be executed remotely.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where the affected WordPress site is hosted.

Remediation

Users can update to version 1.5.7 or a newer patched version to address this vulnerability.