CVE-2026-9860: 
WordPress vulnerability analysis and mitigation

CVE-2026-9860 is a Remote Code Execution (RCE) vulnerability in the "Offload, AI & Optimize with Cloudflare Images" WordPress plugin (by vanyukov), affecting all versions up to and including 1.10.2. The flaw allows authenticated attackers with Author-level access or above to execute arbitrary PHP code on the server by injecting malicious input via the account-id or api-key parameters. It was published on June 18, 2026, with a patch advisory added to the GitHub Advisory Database the same day. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory).

The root cause is a combination of insufficient privilege enforcement (CWE-434) and missing input sanitization in the cf_images_do_setup AJAX handler. The handler requires only the upload_files capability (Author+) rather than the more restrictive manage_options capability before writing user-supplied values to wp-config.php via the write_config() function's define() statements. The sanitize_text_field() function used for input cleaning does not strip single quotes, and filter_input(INPUT_POST) bypasses WordPress's wp_magic_quotes() slashing mechanism — meaning a single quote in the account-id or api-key parameter can break out of the single-quoted PHP string literal and inject arbitrary PHP code. Critically, the cf-images-nonce nonce required by the AJAX handler is exposed to all Author-level and above users on wp-admin/upload.php via the CFImages JavaScript object, allowing any upload-capable user to satisfy the nonce check and reach the vulnerable code path (GitHub Advisory).

Successful exploitation grants an attacker full remote code execution on the web server, with the same privileges as the PHP/web server process. This results in complete compromise of confidentiality, integrity, and availability — an attacker can read sensitive data (including database credentials in wp-config.php), modify site content, install backdoors or web shells, and potentially pivot to other systems on the same host or network. The low privilege bar (Author-level WordPress account) significantly broadens the attack surface on multi-user WordPress installations (GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the "Offload, AI & Optimize with Cloudflare Images" plugin version ≤ 1.10.2. This can be done by checking /wp-content/plugins/cf-images/readme.txt or similar plugin metadata endpoints.
2. Obtain Author-level credentials: Register or compromise a WordPress account with at least Author-level (upload_files) privileges on the target site.
3. Retrieve the nonce: Log in and navigate to wp-admin/upload.php. Inspect the page source or JavaScript objects to extract the cf-images-nonce value from the CFImages JavaScript object exposed on that page.
4. Craft the malicious AJAX request: Send a POST request to wp-admin/admin-ajax.php with action=cf_images_do_setup, the retrieved nonce, and a crafted account-id or api-key parameter containing a single quote followed by arbitrary PHP code (e.g., '; system($_GET['cmd']); define('X', ').
5. Trigger wp-config.php write: The write_config() function writes the unsanitized input into a define() statement in wp-config.php, injecting the attacker's PHP payload into the file.
6. Execute arbitrary code: Any subsequent request to the WordPress site will cause the injected PHP code in wp-config.php to execute, granting the attacker remote code execution on the server (GitHub Advisory).

• Network: Unusual POST requests to wp-admin/admin-ajax.php with action=cf_images_do_setup from non-administrative user sessions; unexpected outbound connections from the web server process following plugin setup requests.
• File System: Unexpected or modified content in wp-config.php, particularly new or altered define() statements containing PHP code, shell commands, or unusual string values; presence of new web shell files in the WordPress installation directory.
• Logs: Web server access logs showing POST requests to admin-ajax.php?action=cf_images_do_setup from Author-level user sessions; PHP error logs referencing write_config() or unexpected parse errors in wp-config.php.
• Process: Unusual child processes spawned by the web server (e.g., sh, bash, curl, wget) following AJAX requests to the plugin handler.

Update the "Offload, AI & Optimize with Cloudflare Images" plugin to a version beyond 1.10.2, which addresses the insufficient privilege check and missing input escaping (GitHub Advisory). As interim workarounds: restrict Author-level WordPress accounts to only fully trusted users; implement network or WAF controls to limit access to wp-admin/upload.php and wp-admin/admin-ajax.php for lower-privileged roles; and monitor wp-config.php for unauthorized modifications using file integrity monitoring tools. Disabling the plugin entirely until a patch is applied is also a viable option for high-risk environments.

Wordfence included CVE-2026-9860 in their weekly WordPress vulnerability report for the period of June 15–21, 2026, highlighting it as a notable RCE finding (Wordfence Blog). The vulnerability was also tracked by VulnDB and several threat intelligence aggregators shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been identified at this time.