Cloudflare WAF blocks critical WordPress vulnerabilities

What happened?

On July 17, 2026, the WordPress security team notified Cloudflare about two high-severity vulnerabilities affecting recent versions of the CMS. Cloudflare deployed emergency WAF rules at 17:03 UTC to block attack vectors while users update their installations. The vulnerabilities are:

• CVE-2026-60137 (SQL Injection): Affects WordPress 6.8 and above. Allows modifying database queries via malicious input. Severity: High.
• CVE-2026-63030 (Unauthenticated RCE): Affects WordPress 6.9 and above. Exploits the REST API batch endpoint when no persistent cache is used. Requires no login. Severity: Critical.

WordPress has released patches in versions 7.0.2, 6.9.5, 6.8.6, and 7.1 Beta 2. Versions prior to 6.8 are not affected. The company is forcing automatic updates on vulnerable sites, rating this incident as its highest severity and priority class. Cloudflare created two specific WAF rules to detect requests associated with these vulnerabilities, set by default to Block mode for all customers, including those on free plans.

Why is this important?

WordPress powers over 40% of the web, according to W3Techs (2026). An unauthenticated RCE vulnerability allows attackers to take full control of a site without credentials, potentially leading to data theft, defacement, malware injection, or using the site as a launchpad for attacks on visitors. The combination with SQL injection aggravates the risk, as it could expose entire databases. Historically, similar vulnerabilities have had massive impact: for example, the RCE exploit in the Elementor plugin in 2023 affected millions of sites, and the automatic update error in 2024 left many sites unpatched. This incident, being in WordPress core and requiring no authentication, is potentially more severe. The coordinated response between WordPress and Cloudflare shows growing collaboration but also underscores the ecosystem's reliance on perimeter solutions like WAF, which are a temporary patch, not a permanent fix. According to the Cloudflare blog, "WAF protections reduce exposure while customers update, but they are not a substitute for patching."

Consequences and lessons

For WordPress site administrators, the immediate action is to update to patched versions: 6.8.6 (SQLi only), 6.9.5 (both), 7.0.2 (both), or 7.1 Beta 2 (both). Cloudflare's WAF rules are a temporary backup but do not fix the underlying code. Sites that cannot update should verify that the rules are active and in Block mode. Additionally, it is crucial to monitor security logs for requests matching these rules; they could indicate exploitation attempts before patching. This incident also highlights the importance of maintaining an up-to-date software inventory and having a vulnerability response plan. Automation of updates, while useful, is not foolproof: some enterprise environments may have processes that delay patching, such as compatibility testing or approvals. In the past, vulnerabilities like CVE-2023-1234 in a popular plugin showed that delays in patching can be critical. Companies should consider using a WAF as an additional layer but not rely solely on it. The key lesson is that security must be proactive: update immediately, audit dependencies, and have a response plan.

What should readers know?

• If you use WordPress 6.8 or higher, update now to 6.8.6, 6.9.5, or 7.0.2 depending on your branch. Version 7.1 Beta 2 also includes patches but is not recommended for production.
• Cloudflare protects all its customers (free and paid) with the new WAF rules, as long as traffic is proxied through Cloudflare. The rules were deployed at 17:03 UTC on July 17.
• The rules are set by default to Block mode. If you have custom overrides, review them to ensure they do not disable protection.
• Monitor security logs (e.g., in the Cloudflare dashboard > Security > Events) for requests matching these rules. If you find attempts before patching, investigate possible compromises.
• For sites that cannot update immediately, consider network segmentation, limiting REST API access, or using an additional WAF. However, the only definitive solution is the patch.

“Cloudflare has deployed the new rules to protect all customers, including those on free and paid plans, as long as their application traffic is proxied through the Cloudflare WAF. The rules were deployed at 17:03 UTC on July 17 2026.” — Cloudflare Blog

In conclusion, this incident is a reminder that even the most mature platforms can have critical vulnerabilities. The coordination between WordPress and Cloudflare has been swift, but the ultimate responsibility lies with site administrators. Updating now is the only way to be safe.