CVE-2025-66104 Overview
CVE-2025-66104 is a missing authorization vulnerability in the Anton Vanyukov Offload, AI & Optimize with Cloudflare Images (cf-images) WordPress plugin. The flaw affects all versions up to and including 1.9.5. The plugin fails to enforce proper access control checks on sensitive actions, allowing authenticated users with low privilege levels to perform operations reserved for higher-privileged roles. The vulnerability is categorized under CWE-862: Missing Authorization and impacts site availability. Attackers do not need user interaction to exploit the issue over the network.
Critical Impact
Authenticated attackers with low privileges can abuse incorrectly configured access control to disrupt plugin operations, leading to high availability impact on affected WordPress installations.
Affected Products
- Anton Vanyukov Offload, AI & Optimize with Cloudflare Images (cf-images) plugin for WordPress
- All versions from initial release through 1.9.5
- WordPress sites that have the plugin installed and activated
Discovery Timeline
- 2025-12-18 - CVE-2025-66104 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-66104
Vulnerability Analysis
The vulnerability stems from missing authorization checks within one or more handlers in the cf-images plugin. The plugin exposes functionality that should be restricted to administrative roles, but it does not verify the caller's capability before executing the requested action. Any authenticated user, including low-privilege roles such as subscribers, can trigger protected code paths.
Successful exploitation results in high availability impact on the WordPress site. Confidentiality and integrity are not directly affected according to the published vector, but service disruption of the Cloudflare Images offload workflow is possible. The attack is network-reachable and requires low attack complexity, making it practical against exposed WordPress installations with open registration.
For technical specifics on the affected endpoints, see the Patchstack Vulnerability Advisory.
Root Cause
The root cause is improper enforcement of access control at security-sensitive entry points. The plugin's AJAX or REST handlers do not call current_user_can() with an appropriate capability, nor do they validate nonces consistently. This results in CWE-862: Missing Authorization, where privileged operations are reachable by any authenticated session.
Attack Vector
An attacker authenticates to the target WordPress site using any valid account, including self-registered subscriber accounts if open registration is enabled. The attacker then sends crafted HTTP requests to the plugin's unprotected endpoints to trigger administrative actions. No social engineering or user interaction is required.
No verified public exploit code is available for CVE-2025-66104. Refer to the Patchstack advisory for additional technical context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-66104
Indicators of Compromise
- Unexpected changes to the cf-images plugin configuration or Cloudflare Images integration settings
- Authenticated HTTP requests from low-privilege user accounts to cf-images plugin AJAX or REST endpoints
- Spikes in failed or anomalous Cloudflare Images API calls originating from the WordPress host
Detection Strategies
- Review WordPress audit logs for actions performed by non-administrative accounts against the cf-images plugin
- Correlate web server access logs with plugin endpoint URIs to identify unauthorized access attempts
- Monitor for newly registered low-privilege accounts followed by requests to plugin-specific routes
Monitoring Recommendations
- Enable a WordPress activity logging plugin to track capability-sensitive events and plugin option changes
- Forward WordPress and web server logs to a centralized logging platform for correlation and alerting
- Alert on HTTP 200 responses to plugin endpoints originating from subscriber-level session cookies
How to Mitigate CVE-2025-66104
Immediate Actions Required
- Identify all WordPress sites running the cf-images plugin at version 1.9.5 or earlier
- Disable or deactivate the plugin until a patched version is confirmed deployed
- Audit WordPress user accounts and remove unused or untrusted low-privilege accounts
- Disable open user registration if it is not required for site operation
Patch Information
At the time of publication, the vendor advisory on Patchstack lists all versions up to and including 1.9.5 as affected. Administrators should monitor the Patchstack Vulnerability Advisory and the WordPress plugin repository for a fixed release and update immediately once published.
Workarounds
- Restrict access to the WordPress admin area and wp-admin/admin-ajax.php using a web application firewall (WAF) rule that filters plugin-specific actions by role
- Enforce multi-factor authentication for all WordPress accounts to reduce the risk of credential-based access to the exploit precondition
- Temporarily remove the plugin directory from wp-content/plugins/cf-images/ if deactivation is not feasible
# Configuration example: deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate cf-images
wp plugin status cf-images
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
