onyx --cves cve-2026-9860
CVE-2026-9860
- score
- 0.1
- cvss
- 8.8
- epss
- 1.1%
- published
- 2026-06-18
- kev added
- —
- first seen
Cloudflare Offload, AI & Optimize with Cloudflare Images WordPress plugin <= 1.10.2 contains a remote code execution caused by insufficient privilege enforcement and improper input sanitization in cf_images_do_setup AJAX handler, letting authenticated authors execute code on the server, exploit requires author-level or higher privileges.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 6
- https://plugins.trac.wordpress.org/browser/cf-images/tags/1.10.1/app/class-settings.php#L75
- https://plugins.trac.wordpress.org/browser/cf-images/tags/1.10.1/app/traits/trait-ajax.php#L36
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3564001%40cf-images&new=3564001%40cf-images&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a772041e-015e-48e8-9fab-79f1fcdb265c?source=cve
- https://plugins.trac.wordpress.org/browser/cf-images/tags/1.10.1/app/class-media.php#L94
- https://plugins.trac.wordpress.org/browser/cf-images/tags/1.10.1/app/class-settings.php#L123