The Offload, AI & Optimize with Cloudflare Images WordPress plugin allows an authenticated user with author or higher privileges to execute arbitrary PHP code on the hosting server. The vulnerability resides in the cf_images_do_setup AJAX handler, which writes to wp-config.php after performing only an upload_files capability check. Because the handler does not escape single‑quotes in the account-id or api‑key parameters, a single quote can break the PHP string literal surrounding the define() call, allowing arbitrary code to be inserted. The vulnerability is a classic uncontrolled write of a configuration file, mapped to CWE‑434.

All installations of Offload, AI & Optimize with Cloudflare Images up to and including version 1.10.2 are affected. Users running WordPress with this plugin should verify that the plugin version does not exceed 1.10.2; versions beyond that are not known to be vulnerable.

The CVSS score of 8.8 indicates a high‑severity flaw, but the EPSS score is under 1%, suggesting low current exploitation activity. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated author‑level or higher account, access to the wp-admin/upload.php page to obtain the required nonce, and the ability to send crafted AJAX requests to the plugin. Once completed, the attacker can have full code execution rights on the server. Given the severity, any instance that is still running a vulnerable version should be treated as a high‑risk exposure.