CVE-2026-9860

🗓️ 18 Jun 2026 04:31:08Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 86 Views🌐 WEB

Author+ users can execute code via cf_images_do_setup in Cloudflare Images ≤1.10.2 using account-id or api-key in AJAX.

Reporter	Title	Published	Views	Family All 7
ATTACKERKB	CVE-2026-9860	18 Jun 202604:31	–	attackerkb
Cvelist	CVE-2026-9860 Offload, AI & Optimize with Cloudflare Images <= 1.10.2 - Authenticated (Author+) Remote Code Execution via 'api-key' / 'account-id' Parameters in cf_images_do_setup AJAX Action	18 Jun 202604:31	–	cvelist
EUVD	EUVD-2026-37840	18 Jun 202604:31	–	euvd
NVD	CVE-2026-9860	18 Jun 202606:16	–	nvd
Patchstack	WordPress Offload, AI & Optimize with Cloudflare Images plugin <= 1.10.2 - Authenticated (Author+) Remote Code Execution vulnerability	18 Jun 202608:49	–	patchstack
Positive Technologies	PT-2026-50634	18 Jun 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-9860 Offload, AI & Optimize with Cloudflare Images <= 1.10.2 - Authenticated (Author+) Remote Code Execution via 'api-key' / 'account-id' Parameters in cf_images_do_setup AJAX Action	18 Jun 202604:31	–	vulnrichment

Vulners

Node

vanyukov offload,_ai_&_optimize_with_cloudflare_imagesRange≤1.10.2wordpress

[
  {
    "vendor": "vanyukov",
    "product": "Offload, AI & Optimize with Cloudflare Images",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.10.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/cf-images/tags/1.10.1/app/traits/trait-ajax.php
plugins	www.plugins.trac.wordpress.org/browser/cf-images/tags/1.10.1/app/class-media.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/a772041e-015e-48e8-9fab-79f1fcdb265c
plugins	www.plugins.trac.wordpress.org/browser/cf-images/tags/1.10.1/app/class-settings.php
plugins	www.plugins.trac.wordpress.org/browser/cf-images/tags/1.10.1/app/class-settings.php

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	Authenticated users with author+ access can trigger the cf_images_do_setup AJAX handler to write to wp-config.php due to insufficient privilege checks and unsafe string handling, enabling remote code execution.	CWE-434
account-id	request body	/wp-admin/admin-ajax.php	Authenticated users with author+ access can trigger the cf_images_do_setup AJAX handler to write to wp-config.php due to insufficient privilege checks and unsafe string handling, enabling remote code execution.	CWE-434
api-key	request body	/wp-admin/admin-ajax.php	Authenticated users with author+ access can trigger the cf_images_do_setup AJAX handler to write to wp-config.php due to insufficient privilege checks and unsafe string handling, enabling remote code execution.	CWE-434
cf-images-nonce	request body	/wp-admin/admin-ajax.php	Authenticated users with author+ access can trigger the cf_images_do_setup AJAX handler to write to wp-config.php due to insufficient privilege checks and unsafe string handling, enabling remote code execution.	CWE-434
upload_files	request body	/wp-admin/admin-ajax.php	Authenticated users with author+ access can trigger the cf_images_do_setup AJAX handler to write to wp-config.php due to insufficient privilege checks and unsafe string handling, enabling remote code execution.	CWE-434
_wpnonce	request body	/wp-admin/admin-ajax.php	Authenticated users with author+ access can trigger the cf_images_do_setup AJAX handler to write to wp-config.php due to insufficient privilege checks and unsafe string handling, enabling remote code execution.	CWE-434
cf-images-nonce	nested	/wp-admin/upload.php	The CFImages JavaScript object exposes the cf-images-nonce to Author+ users on the upload page, allowing them to reach the vulnerable AJAX path and potentially exploit the wp-config.php write flow.	CWE-434
Upload capabilities	nested	/wp-admin/upload.php	The CFImages JavaScript object exposes the cf-images-nonce to Author+ users on the upload page, allowing them to reach the vulnerable AJAX path and potentially exploit the wp-config.php write flow.	CWE-434
action	nested	/wp-admin/upload.php	The CFImages JavaScript object exposes the cf-images-nonce to Author+ users on the upload page, allowing them to reach the vulnerable AJAX path and potentially exploit the wp-config.php write flow.	CWE-434
account-id	nested	/wp-admin/upload.php	The CFImages JavaScript object exposes the cf-images-nonce to Author+ users on the upload page, allowing them to reach the vulnerable AJAX path and potentially exploit the wp-config.php write flow.	CWE-434

18 Jun 2026 19:16Current

6Medium risk

Vulners AI Score6

CVSS 3.18.8

EPSS0.0056

SSVC

CWE-434