| Reporter | Title | Published | Views | Family All 8 |
|---|---|---|---|---|
 | CVE-2026-9860 | 18 Jun 202604:31 | – | attackerkb |
 | CVE-2026-9860 Offload, AI & Optimize with Cloudflare Images <= 1.10.2 - Authenticated (Author+) Remote Code Execution via 'api-key' / 'account-id' Parameters in cf_images_do_setup AJAX Action | 18 Jun 202604:31 | – | cvelist |
 | EUVD-2026-37840 | 18 Jun 202604:31 | – | euvd |
 | CVE-2026-9860 | 18 Jun 202606:16 | – | nvd |
 | WordPress Offload, AI & Optimize with Cloudflare Images plugin <= 1.10.2 - Authenticated (Author+) Remote Code Execution vulnerability | 18 Jun 202608:49 | – | patchstack |
 | PT-2026-50634 | 18 Jun 202600:00 | – | ptsecurity |
 | CVE-2026-9860: Unrestricted Upload of File with Dangerous Type | 18 Jun 202600:00 | – | rapid7 |
 | CVE-2026-9860 Offload, AI & Optimize with Cloudflare Images <= 1.10.2 - Authenticated (Author+) Remote Code Execution via 'api-key' / 'account-id' Parameters in cf_images_do_setup AJAX Action | 18 Jun 202604:31 | – | vulnrichment |
[
{
"vendor": "vanyukov",
"product": "Offload, AI & Optimize with Cloudflare Images",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "1.10.2",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| account-id | request body | wp-admin/upload.php | Remote Code Execution via the cf_images_do_setup AJAX handler due to insufficient privilege enforcement and insecure input handling; an attacker with author-level access can inject code via account-id/api-key to break out of the PHP string in wp-config.php write. | CWE-434 |
| api-key | request body | wp-admin/upload.php | Remote Code Execution via the cf_images_do_setup AJAX handler due to insufficient privilege enforcement and insecure input handling; an attacker with author-level access can inject code via account-id/api-key to break out of the PHP string in wp-config.php write. | CWE-434 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
18 Jun 2026 19:16Current
6Medium risk
Vulners AI Score6
CVSS 3.18.8
EPSS0.01078
SSVC