EUVD-2026-37840
GHSA-8284-5r7j-c9f4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable AJAX endpoint (AV:N), straightforward single-quote payload (AC:L), Author account required (PR:L), no victim interaction (UI:N); arbitrary PHP in wp-config.php yields full C/I/A impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Offload, AI & Optimize with Cloudflare Images plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.10.2 via the 'account-id' parameter parameter. This is due to insufficient privilege enforcement on the cf_images_do_setup AJAX handler, which requires only the upload_files capability (Author+) rather than manage_options before writing to wp-config.php, combined with the absence of single-quote escaping - sanitize_text_field() does not strip single quotes, and filter_input(INPUT_POST) bypasses wp_magic_quotes() slashing - allowing a single quote in the account-id or api-key parameter to break out of the single-quoted PHP string literal in the write_config() define() statement. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. This is possible because the 'cf-images-nonce' nonce required by the AJAX handler is exposed to all Author-level and above users on wp-admin/upload.php via the CFImages JavaScript object, meaning any upload-capable user can satisfy the nonce check and reach the vulnerable wp-config.php write path.
Articles & Coverage 1
AnalysisAI
Remote code execution in the Offload, AI & Optimize with Cloudflare Images WordPress plugin (versions ≤1.10.2) allows authenticated Author-level users to inject PHP into wp-config.php via the 'account-id' or 'api-key' parameters of the cf_images_do_setup AJAX handler. The handler enforces only the upload_files capability instead of manage_options, and a single-quote escape flaw lets attackers break out of a PHP string literal during the define() write. No public exploit is identified at time of analysis, but the vulnerability is reported by Wordfence with detailed root-cause analysis.
Technical ContextAI
The plugin (cpe:2.3:a:vanyukov:offload,_ai_&_optimize_with_cloudflare_images) implements an AJAX setup flow in app/class-settings.php and app/traits/trait-ajax.php that writes Cloudflare account credentials into wp-config.php via a define() statement using single-quoted PHP string literals. The CWE-434 (Unrestricted File Upload) classification is somewhat loose here - the practical root cause is a combination of broken access control (CWE-862) and improper neutralization of special elements (CWE-94/CWE-78-style escape break) in the write_config() routine. sanitize_text_field() preserves single quotes, and filter_input(INPUT_POST) bypasses WordPress's wp_magic_quotes() slashing, so a single quote in account-id closes the literal and the remainder of the string becomes executable PHP at runtime. The cf-images-nonce required by the handler is exposed to every Author+ user via the CFImages JS object on wp-admin/upload.php, eliminating the nonce as a barrier.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - the WordPress plugin changeset 3564001 referenced in the CVE data corresponds to the corrective commit on the cf-images repository, but the input data does not name a tagged 1.10.3+ release, so administrators should update to the latest available cf-images plugin version from the WordPress.org plugin directory and verify the installed version is greater than 1.10.2. As a compensating control until patching, restrict or revoke Author-and-above accounts that are not strictly required, audit existing Author accounts for unexpected behaviour, and consider temporarily deactivating the cf-images plugin (which disables Cloudflare image offloading and any pages depending on it). A web application firewall rule blocking POST requests to admin-ajax.php with action=cf_images_do_setup containing a single quote in account-id or api-key is a narrow stop-gap, but may break legitimate setup attempts and should be removed after patching. Review wp-config.php for any unexpected define() lines or appended PHP as part of incident response, since exploitation persists by modifying that file.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today