CVE-2026-9860

Name of the Vulnerable Software and Affected Versions Offload, AI & Optimize with Cloudflare Images versions prior to 1.10.3

Description The Offload, AI & Optimize with Cloudflare Images plugin for WordPress allows authenticated attackers with author-level access and above to execute remote code on the server. The issue exists in the cf images do setup() AJAX handler, which incorrectly requires only the upload files capability instead of manage options before writing to the wp-config.php file. Because sanitize text field() does not strip single quotes and filter input(INPUT POST) bypasses wp magic quotes() slashing, a single quote in the account-id or api-key parameters can break out of the single-quoted PHP string literal in the write config() define() statement. Additionally, the cf-images-nonce nonce required by the handler is exposed to all users with author-level access or higher on wp-admin/upload.php via the CFImages JavaScript object.

Recommendations Update the plugin to a version later than 1.10.2. As a temporary workaround, restrict access to the cf images do setup() AJAX handler or limit user permissions to prevent users with author-level access from reaching the wp-admin/upload.php page.