CVE-2026-9860: CWE-434 Unrestricted Upload of File with Dangerous Type in vanyukov Offload, AI & Optimize with Cloudflare Images
The Offload, AI & Optimize with Cloudflare Images plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.10.2 via the 'account-id' parameter parameter. This is due to insufficient privilege enforcement on the cf_images_do_setup AJAX handler, which requires only the upload_files capability (Author+) rather than manage_options before writing to wp-config.php, combined with the absence of single-quote escaping — sanitize_text_field() does not strip single quotes, and filter_input(INPUT_POST) bypasses wp_magic_quotes() slashing — allowing a single quote in the account-id or api-key parameter to break out of the single-quoted PHP string literal in the write_config() define() statement. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. This is possible because the 'cf-images-nonce' nonce required by the AJAX handler is exposed to all Author-level and above users on wp-admin/upload.php via the CFImages JavaScript object, meaning any upload-capable user can satisfy the nonce check and reach the vulnerable wp-config.php write path.
AI Analysis
Technical Summary
CVE-2026-9860 is a remote code execution vulnerability in the Offload, AI & Optimize with Cloudflare Images WordPress plugin affecting all versions up to and including 1.10.2. The issue stems from the cf_images_do_setup AJAX handler which improperly enforces privileges by requiring only upload_files capability (author-level) instead of manage_options before writing to wp-config.php. Additionally, the input parameters 'account-id' and 'api-key' are not properly escaped, allowing single quotes to break out of PHP string literals in the write_config() define() statement. The required nonce for the AJAX handler is accessible to author-level users via the CFImages JavaScript object, enabling any user with upload capability to exploit this flaw and execute arbitrary code on the server.
Potential Impact
An authenticated user with author-level privileges or higher can exploit this vulnerability to execute arbitrary code on the server hosting the WordPress site. This can lead to full compromise of the server, including data theft, site defacement, or further attacks. The vulnerability affects confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
A patch is available for this vulnerability. Since the product is a cloud service, the vendor manages remediation server-side. Users should apply the official update or patch provided by the vendor as soon as possible. Until patched, restrict author-level user capabilities if feasible. Check the vendor advisory for the latest remediation guidance.
CVE-2026-9860: CWE-434 Unrestricted Upload of File with Dangerous Type in vanyukov Offload, AI & Optimize with Cloudflare Images
Description
The Offload, AI & Optimize with Cloudflare Images plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.10.2 via the 'account-id' parameter parameter. This is due to insufficient privilege enforcement on the cf_images_do_setup AJAX handler, which requires only the upload_files capability (Author+) rather than manage_options before writing to wp-config.php, combined with the absence of single-quote escaping — sanitize_text_field() does not strip single quotes, and filter_input(INPUT_POST) bypasses wp_magic_quotes() slashing — allowing a single quote in the account-id or api-key parameter to break out of the single-quoted PHP string literal in the write_config() define() statement. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. This is possible because the 'cf-images-nonce' nonce required by the AJAX handler is exposed to all Author-level and above users on wp-admin/upload.php via the CFImages JavaScript object, meaning any upload-capable user can satisfy the nonce check and reach the vulnerable wp-config.php write path.
CVSS v3.1
Score 8.8high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-9860 is a remote code execution vulnerability in the Offload, AI & Optimize with Cloudflare Images WordPress plugin affecting all versions up to and including 1.10.2. The issue stems from the cf_images_do_setup AJAX handler which improperly enforces privileges by requiring only upload_files capability (author-level) instead of manage_options before writing to wp-config.php. Additionally, the input parameters 'account-id' and 'api-key' are not properly escaped, allowing single quotes to break out of PHP string literals in the write_config() define() statement. The required nonce for the AJAX handler is accessible to author-level users via the CFImages JavaScript object, enabling any user with upload capability to exploit this flaw and execute arbitrary code on the server.
Potential Impact
An authenticated user with author-level privileges or higher can exploit this vulnerability to execute arbitrary code on the server hosting the WordPress site. This can lead to full compromise of the server, including data theft, site defacement, or further attacks. The vulnerability affects confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
A patch is available for this vulnerability. Since the product is a cloud service, the vendor manages remediation server-side. Users should apply the official update or patch provided by the vendor as soon as possible. Until patched, restrict author-level user capabilities if feasible. Check the vendor advisory for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-05-28T16:16:47.763Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
Threat ID: 6a33875bf198dc38c1370f39
Added to database: 06/18/2026, 05:51:23 UTC
Last enriched: 06/18/2026, 06:05:02 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 89
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.