Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities

Cloudflare ships WAF rules for critical WordPress flaws

Cloudflare has rolled out new Web Application Firewall (WAF) protections targeting two high-severity vulnerabilities in WordPress: an unauthenticated remote code execution (RCE) flaw in the REST API and an associated SQL injection issue. The rules went live at 17:03 UTC on July 17, 2026, and apply to all proxied traffic, including customers on free plans.

The WordPress security team disclosed both vulnerabilities to Cloudflare ahead of public release to allow preparation of defensive measures. The WAF rules reduce exposure while sites are updated, but they do not patch the underlying code. WordPress has issued fixes in version 7.0.2 with backports to 6.9.5, 6.8.6, and 7.1 Beta 2. Versions prior to 6.8 are unaffected. Because WordPress is treating this as its highest-priority issue, automatic updates are being forced to affected sites; administrators should still confirm their installations are on a patched release. Note that version 6.8.6 addresses only the SQL injection, since the RCE does not affect the 6.8 branch, while 6.9.5, 7.0.2, and 7.1 Beta 2 include fixes for both.

Rule deployment and configuration

Cloudflare has added two rules to detect requests matching these attack patterns. Pro, Business, and Enterprise customers running WordPress should ensure Cloudflare Managed Rules are enabled following the instructions in the WAF Managed Rules documentation. Free plan customers are automatically covered through the Free Ruleset. The new rules ship with the default Managed Ruleset action of Block. Organizations should audit any ruleset-level overrides, especially those that switch rules from Block to Log, and verify the new rules retain the recommended action during the update window. Traffic matching either rule should also be reviewed in Security Events.

Detection points and patch guidance

The SQL injection rule inspects crafted parameter values before they reach WordPress. The RCE rule targets requests aimed at the vulnerable code execution path. Together, the rules catch attack attempts at two distinct stages of the request lifecycle.

These protections only reduce risk while systems are updated; upgrading WordPress remains the definitive fix. If an immediate update is not possible, confirm both Cloudflare rules are active with the recommended action and monitor logs for suspicious requests directed at the affected REST API endpoint. Cloudflare will continue tracking matching traffic, testing rules against new attack variations, and refining detections as needed.