Cloudflare WAF blocks two critical WordPress vulnerabilities

Cloudflare has rolled out Web Application Firewall (WAF) protections to shield WordPress sites from two newly disclosed vulnerabilities rated as high and critical severity. The rules target an unauthenticated remote code execution (RCE) flaw and a SQL injection vulnerability, both affecting recent WordPress releases. Protections were activated at 17:03 UTC on the day of disclosure, covering all Cloudflare customers with proxied traffic, including free-tier users, though patching remains the recommended fix for site operators.

What the vulnerabilities entail

The two flaws, tracked as CVE-2026-63030 and CVE-2026-60137, exploit distinct attack vectors within WordPress. The RCE vulnerability (CVE-2026-63030) allows unauthenticated attackers to execute arbitrary code via the REST API’s batch endpoint, provided no persistent object cache is in use. No user interaction or credentials are required for exploitation, and the flaw is present in WordPress versions 6.9 and later. The SQL injection issue (CVE-2026-60137), rated high severity, affects versions 6.8 and above, enabling crafted input to manipulate database queries.

WordPress has released patches in version 7.0.2, with backports available for 6.9.5, 6.8.6, and 7.1 Beta 2. Versions prior to 6.8 are unaffected. The WordPress security team has prioritized automatic updates for affected sites, though manual verification of patch installation is advised. Cloudflare’s WAF rules act as a temporary safeguard, blocking malicious requests at the network edge while operators apply updates.

How Cloudflare’s protections work

Cloudflare has implemented two WAF rules to detect and block exploitation attempts. The first rule targets the SQL injection vulnerability by identifying malicious parameter values before they reach the WordPress application. The second rule focuses on the RCE flaw, intercepting requests attempting to access the vulnerable REST API endpoint. Both rules are enabled by default with a block action for all Cloudflare customers, including those on free plans, though users can override this behavior.

For customers on Pro, Business, or Enterprise plans, Cloudflare recommends verifying that the managed ruleset is active and reviewing any overrides that might change the default block action to log-only. Free-tier users are protected automatically but should still monitor security events for requests matching either rule. Cloudflare has published documentation outlining steps to confirm rule activation and adjust settings if necessary.

Risks and next steps

While Cloudflare’s WAF rules reduce exposure, they do not address the underlying vulnerabilities. Site operators must update WordPress to a patched version to fully resolve the risks. Cloudflare has stated it will continue monitoring traffic for new attack variations and update the rules as needed. The company credited the WordPress security team for coordinating the disclosure, allowing infrastructure providers to prepare protections ahead of public release.

WordPress’s automatic update mechanism is expected to mitigate the issue for most sites, but manual checks are recommended for environments where auto-updates are disabled or delayed. Operators unable to patch immediately should ensure Cloudflare’s WAF rules remain active and review logs for suspicious activity targeting the affected endpoints.