Authenticated RCE in Offload, AI & Optimize with Cloudflare Images <= 1.10.2 via AJAX Params

Vulnerability Overview Vulnerability Name: Offload, AI & Optimize with Cloudflare Images <= 1.10.2 - Authenticated (Author+) Remote Code Execution via 'api-key' / 'account-id' Parameters in cf_images_do_setup AJAX Action CVE ID: CVE-2026-9860 CVSS Score: 8.8 (High) Publication Date: June 17, 2026 Last Updated Date: June 18, 2026 Researcher: Yat Affected Scope Affected Software: Offload, AI & Optimize with Cloudflare Images Affected Versions: <= 1.10.2 Software Type: Plugin Software Slug: cf-images (view on wordpress.org) Remediation Fixed Version: 1.10.3 Remediation Advice: Update to version 1.10.3 or later patched version Vulnerability Description This vulnerability allows an authenticated attacker (Author level and above) to execute remote code via the and parameters in the AJAX action. The vulnerability is caused by insufficient permission checks; an attacker can leverage the capability instead of to bypass single-quote escaping in , thereby executing arbitrary code. References plugins.trac.wordpress.org Additional Information Disclaimer: This record contains copyrighted material, the copyright of which belongs to Defiant Inc. and MITRE Corporation. Contact: For any errors or if more information is needed, please contact support@wordfence.com. Related Recent Vulnerabilities Vulnerability Title: Offload, AI & Optimize with Cloudflare Images <= 1.9.5 - Missing Authorization CVE ID: CVE-2025-61104 CVSS Score: 4.3 Researcher: Nabi Irawan Publication Date: November 20, 2025 Summary This vulnerability allows an authenticated attacker to execute remote code through a specific AJAX action, affecting versions 1.10.2 and below of the Offload, AI & Optimize with Cloudflare Images plugin. It is recommended that users update to version 1.10.3 or higher as soon as possible to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Authenticated RCE in Offload, AI & Optimize with Cloudflare Images <= 1.10.2 via AJAX Params

More from this source