Executive brief
A vulnerability in a popular WordPress plugin used for optimizing and offloading images to Cloudflare allows users with 'Author' level access or higher to take complete control of the website. By exploiting a flaw in how the plugin saves its configuration, an attacker can inject and execute malicious code on the server. This could lead to a total site takeover, theft of sensitive data, or the installation of malware.
Technical details
The vulnerability exists in the cf_images_do_setup AJAX handler, which incorrectly requires only the 'upload_files' capability (Author level) instead of 'manage_options' (Administrator level). The handler fails to properly escape single quotes when processing the 'account-id' or 'api-key' parameters, as sanitize_text_field() does not strip single quotes and filter_input(INPUT_POST) bypasses standard WordPress magic quotes. An authenticated attacker can use a single quote to break out of the PHP string literal in the write_config() define() statement within wp-config.php, leading to arbitrary code execution. The required 'cf-images-nonce' is also exposed to Author-level users via the CFImages JavaScript object on the media upload page, facilitating the attack.
Affected products
- vanyukov Offload, AI & Optimize with Cloudflare Images <= 1.10.2
Timeline
- 2026-06-18: advisory: NVD and Wordfence published the vulnerability details.
References
- https://plugins.trac.wordpress.org/browser/cf-images/tags/1.10.1/app/class-media.php
- https://plugins.trac.wordpress.org/browser/cf-images/tags/1.10.1/app/class-settings.php
- https://plugins.trac.wordpress.org/browser/cf-images/tags/1.10.1/app/class-settings.php
- https://plugins.trac.wordpress.org/browser/cf-images/tags/1.10.1/app/traits/trait-ajax.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3564001%40cf-images&new=3564001%40cf-images&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a772041e-015e-48e8-9fab-79f1fcdb265c?source=cve