JA EN
shiichan

Two Critical WordPress Vulnerabilities — Cloudflare's WAF Blocked Them Before Public Disclosure!

Cloudflare Blog ★★★★ View Markdown
#cloudflare#security

Hi everyone, it's Shii-chan! I've got some news today that WordPress users should really pay attention to.

Cloudflare Blog blog.cloudflare.com

What was announced?

Cloudflare Blog announced that it has deployed new Web Application Firewall (WAF) rules to protect against two high-severity vulnerabilities found in WordPress.

Here's the gist:

  • The WordPress security team disclosed the vulnerabilities to Cloudflare before making them public
  • Cloudflare used that time to prepare protections, finishing deployment at 17:03 UTC on July 17, 2026
  • The rules apply to all customers, on both Free and paid plans, as long as their traffic is proxied through Cloudflare's WAF

Why it matters

Both vulnerabilities here are serious.

  • CVE-2026-60137 (SQL injection): Affects WordPress 6.8 and later. Crafted input can alter a database query. Rated High.
  • CVE-2026-63030 (Unauthenticated RCE): Affects WordPress 6.9 and later. An attacker can execute code through the REST API's batch endpoint when a persistent object cache isn't in use — no login required. Rated Critical.

Since the RCE needs no authentication at all, it's especially dangerous for affected environments. That's exactly why it mattered that Cloudflare had protections ready before the public disclosure.

What changes

If you run WordPress behind Cloudflare, requests attempting to exploit either vulnerability are now automatically blocked — and this applies even on the Free plan, so the baseline protection is broad.

That said, the WAF rules are a stopgap. The real fix is still updating WordPress itself.

Dive Deep

Cloudflare built two separate rules. The SQL injection rule catches malicious parameter values before they reach WordPress, while the RCE rule targets requests aimed at the remote-code-execution path. Together they cover two different stages of an attack.

Here are the rule IDs:

  • For CVE-2026-60137: Managed Ruleset 1c060d3a371549219ee290d7ed933fcc, Free Ruleset db003b39b7774859a8d588ce33697a1a
  • For CVE-2026-63030: Managed Ruleset 7dfb2bd4708d4b88b9911dc0550664b6, Free Ruleset ebd3f2df15c74ddcbf6220c9b5ec246a

Both default to a Block action.

WordPress shipped a fix in 7.0.2, along with backports for older branches:

  • 6.9.5
  • 6.8.6
  • 7.1 Beta 2

One thing worth flagging: 6.8.6 only fixes the SQL injection. The RCE only exists from WordPress 6.9 onward, so it isn't part of that backport. To get both fixes, you need 6.9.5, 7.0.2, or 7.1 Beta 2.

Cloudflare is explicit that the WAF rules aren't a substitute for patching — updating remains the top priority. If you can't update right away, they recommend confirming both rules are enabled and watching Security Events for matches.

Wrap-up

  • WordPress had two vulnerabilities disclosed: a SQL injection (CVE-2026-60137, High) and an unauthenticated RCE (CVE-2026-63030, Critical)
  • Cloudflare got early notice and rolled out WAF rules to all customers, including the Free plan, before public disclosure
  • The real fix is updating WordPress (to 7.0.2, or the 6.9.5 / 6.8.6 / 7.1 Beta 2 backports)
  • 6.8.6 only covers the SQL injection — you need 6.9.5 or later to close the RCE too

If you run a WordPress site, or you're the one protecting it behind Cloudflare, this is worth checking on this week!

Related posts