CVE-2026-9860: Offload, AI & Optimize with Cloudflare Images <= 1.10.2 - Authenticated (Author+) Remote Code Execution via 'api-key' / 'account-id' Parameters in cf_images_do_setup AJAX Action
The Offload, AI & Optimize with Cloudflare Images plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.10.2 via the 'account-id' parameter parameter. This is due to insufficient privilege enforcement on the cfimagesdosetup AJAX handler, which requires only the uploadfiles capability (Author+) rather than manageoptions before writing to wp-config.php, combined with the absence of single-quote escaping — sanitizetextfield() does not strip single quotes, and filterinput(INPUTPOST) bypasses wpmagicquotes() slashing — allowing a single quote in the account-id or api-key parameter to break out of the single-quoted PHP string literal in the writeconfig() define() statement. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. This is possible because the 'cf-images-nonce' nonce required by the AJAX handler is exposed to all Author-level and above users on wp-admin/upload.php via the CFImages JavaScript object, meaning any upload-capable user can satisfy the nonce check and reach the vulnerable wp-config.php write path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Offload, AI & Optimize with Cloudflare Images (WordPress plugin)to a version that resolves this vulnerability.Fixed in 1.10.2 - Configuration
Update the cf_images_do_setup AJAX handler so it enforces manage_options (not only upload_files / Author+ capability) before writing to wp-config.php via the vulnerable write_config() define() path.
WordPress Offload, AI & Optimize with Cloudflare Images plugin cf_images_do_setup AJAX handler privilege enforcement = require manage_options instead of only upload_files (Author+) - Configuration
Fix input handling for the account-id (and api-key) parameters so single quotes are properly escaped when written into wp-config.php in write_config() (the issue occurs because sanitize_text_field() does not strip single quotes and a single quote can break out of the single-quoted PHP string literal).
WordPress Offload, AI & Optimize with Cloudflare Images plugin account-id / api-key input sanitization for write_config() define() = ensure single-quote escaping in single-quoted PHP string literals (do not rely on sanitize_text_field() alone) - Configuration
Change the CFImages JavaScript object so the cf-images-nonce nonce is not exposed to Author-level and above users on wp-admin/upload.php; restrict nonce availability to administrators or otherwise ensure upload-capable Authors cannot satisfy the nonce and reach cf_images_do_setup.
WordPress Offload, AI & Optimize with Cloudflare Images plugin cf-images-nonce exposure scope = restrict cf-images-nonce so it is not exposed to all Author-level users on wp-admin/upload.php - Compensating control
Use a compensating control to prevent non-admin users from accessing wp-admin/upload.php (e.g., restrict Author/Author+ access via WordPress roles/capabilities or an access control layer) so Author+ users cannot reach the exposed cf-images-nonce and trigger the AJAX handler.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9860?
CVE-2026-9860 has a severity rating of 8.8, classified as high.
What versions are affected by CVE-2026-9860?
CVE-2026-9860 affects all versions of the Cloudflare Offload, AI & Optimize with Cloudflare Images plugin up to and including 1.10.2.
How can I fix CVE-2026-9860?
To fix CVE-2026-9860, update the Cloudflare Offload, AI & Optimize with Cloudflare Images plugin to the latest version.
What type of vulnerability is CVE-2026-9860?
CVE-2026-9860 is a Remote Code Execution vulnerability due to insufficient privilege enforcement.
What causes the vulnerability in CVE-2026-9860?
The vulnerability in CVE-2026-9860 is caused by insufficient validation of the 'account-id' parameter in the cf_images_do_setup AJAX handler.