CVE-2026-9860: Cloudflare Images WordPress Plugin Remote Code Execution Vulnerability

Technical summary

CVE-2026-9860 is a Remote Code Execution vulnerability in the Offload, AI & Optimize with Cloudflare Images plugin affecting all versions through 1.10.2. The cf_images_do_setup AJAX handler enforces only the upload_files capability (Author+) instead of manage_options, allowing insufficiently privileged users to write to wp-config.php. The vulnerability combines two weaknesses: (1) the nonce cf-images-nonce is exposed to all Author+ users via the CFImages JavaScript object on wp-admin/upload.php, satisfying AJAX nonce validation, and (2) the account-id and api-key parameters are sanitized with sanitize_text_field() and filter_input(INPUT_POST), neither of which strips single quotes. Since these values are written directly into single-quoted PHP string literals via define() statements, a single quote breaks the string context and allows arbitrary PHP code injection. The absence of wp_magic_quotes() slashing on filter_input() further removes a layer of escaping.

Business impact

This vulnerability poses significant operational risk to WordPress sites relying on the Cloudflare Images plugin. Any author, editor, or contributor with upload capabilities—a common role for content creators—can silently modify the site's configuration file to execute arbitrary code. Once exploited, an attacker gains the same privileges as the web server process, potentially enabling data theft, malware installation, ransomware deployment, or complete site takeover. Organizations managing multiple WordPress instances or allowing third-party content creators should regard this as a critical priority, as the attack requires only legitimate account credentials at a low privilege level.

Affected systems

The Offload, AI & Optimize with Cloudflare Images plugin in all versions up to and including 1.10.2 is affected. This impacts any WordPress installation with the plugin active and at least one user account at Author level or above. The vulnerability is most acute in multi-user environments, such as agencies, publishing platforms, or content networks where author and editor accounts are common. Sites using older versions of the plugin or those with delayed patching cycles face immediate exposure.

Exploitability

This vulnerability is readily exploitable by any authenticated user with Author-level capabilities or above. No special tools, network reconnaissance, or user interaction is required—only a valid WordPress login and the ability to access wp-admin/upload.php. The attack is deterministic: the nonce and AJAX handler are always present and accessible to eligible users, and the input sanitization failure is consistent across all affected versions. The low complexity and lack of user interaction make this a high-confidence, repeatable attack vector suitable for both targeted and opportunistic exploitation.

Remediation

Update the Cloudflare Images plugin to a patched version that (1) restricts the cf_images_do_setup AJAX handler to the manage_options capability, (2) properly escapes or parameterizes all values written to wp-config.php, and (3) removes or restricts exposure of the cf-images-nonce to administrative users only. Verify the specific patched version number against the official Cloudflare or plugin repository advisory. For immediate interim protection, restrict Author and Editor roles, disable the plugin until patching, or use a Web Application Firewall to filter requests to the vulnerable AJAX endpoint.

Patch guidance

Locate the plugin in wp-admin/plugins.php or via wp-cli, note the current version, and apply the latest update once released by the vendor. Verify the patch resolves both the capability check and input escaping issues before re-enabling the plugin in production. Test the Cloudflare Images setup workflow post-patch to confirm functionality. Document the patch date and version for compliance and incident response records.

Detection guidance

Monitor server logs and Web Application Firewall (WAF) logs for requests to /wp-admin/admin-ajax.php containing the action=cf_images_do_setup parameter, especially from non-administrative source IPs or user agents. Flag POST requests with single-quote characters in the account-id or api-key fields. Review wp-config.php modification timestamps and diffs against version control or file integrity monitoring (FIM) systems; unexpected changes may indicate successful exploitation. Audit WordPress user accounts and login histories to identify suspicious Author+ account creation or compromise. Check web server process logs for execution of unexpected PHP code or system commands immediately following wp-config.php modifications.

Why prioritize this

With a CVSS v3.1 score of 8.8 (HIGH), low attack complexity, low privilege threshold, and widespread applicability to WordPress sites using a popular plugin, this vulnerability merits urgent remediation. The combination of easy exploitability and severe impact (full code execution) elevates it above typical plugin vulnerabilities. Organizations should prioritize patching within 24–48 hours, especially if they have author-level users from untrusted or third-party sources.

Risk score, explained

The CVSS 8.8 score reflects a remote, network-accessible attack vector (AV:N) requiring low attack complexity (AC:L), low privileges (PR:L), and no user interaction (UI:N). The impact is severe: High confidentiality (C:H), integrity (I:H), and availability (A:H), as arbitrary code execution enables data exfiltration, modification, and system disruption. The scope is unchanged (S:U), meaning the attacker does not break out of the intended WordPress sandbox into other systems, but since they can rewrite wp-config.php, they effectively own the entire WordPress instance. This score appropriately reflects the severity and ease of exploitation.

Frequently asked questions