JA EN
shiichan

Cloudflare WAF Gets Ahead of 4 Adobe ColdFusion and WordPress Vulnerabilities!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security

Hi everyone, it's Shiichan! Today there's news about Cloudflare's WAF tightening its defenses, so let me share it with you right away!

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog published "WAF Release - 2026-07-21". This release includes targeted protections for Adobe ColdFusion and WordPress vulnerabilities, plus strengthened generic defenses in the WAF against Server-Side Request Forgery (SSRF), Local File Inclusion (LFI), and Cross-Site Scripting (XSS) obfuscation techniques. On top of that, new emergency generic rules for unauthenticated Remote Code Execution (RCE), Authentication Bypass (Auth Bypass - 2), and Information Disclosure were added to cover emerging attack patterns.

Here are the 4 vulnerabilities named in this release.

  • CVE-2026-48276: A path traversal flaw in Adobe ColdFusion's file upload feature. Unauthenticated attackers can write or upload files to arbitrary locations outside the designated directories.
  • CVE-2026-48282: Another Adobe ColdFusion path traversal flaw. Unauthenticated attackers can manipulate directory sequences to read restricted system files they shouldn't be able to access.
  • CVE-2026-60137: An unauthenticated SQL injection in WordPress. Attackers exploit unsanitized input parameters to run arbitrary SQL queries, leading to unauthorized database access, record tampering, or data exfiltration.
  • CVE-2026-63030: An RCE affecting WordPress core and plugin components. Here's how the original post describes it.

Remote, unauthenticated attackers can execute arbitrary system commands to gain unauthorized access or establish backdoors on host servers.

In other words, a remote, unauthenticated attacker can run arbitrary system commands and even plant backdoors — a pretty severe one.

The story so far

Cloudflare's Managed Ruleset keeps adding and updating detection rules as new threats show up. New rules usually start out in Log mode (matching traffic is recorded but not blocked) while the team watches for false positives, and only get promoted to Block once they've proven reliable. This release bundles up a batch of exactly those Log-to-Block promotions.

What changes

If you use the Managed Ruleset, your protection improves with zero extra configuration. The SSRF, LFI, and Adobe ColdFusion detections were all promoted from Log to Block, so traffic that used to just get logged will now be blocked outright.

The WordPress SQL injection (CVE-2026-60137) and RCE (CVE-2026-63030) rules were added as Block not just to the Cloudflare Managed Ruleset, but also to the Cloudflare Free Ruleset. They also moved from being caught under generic "Generic Rules - SQLi" / "Generic Rules - Unauthenticated RCE" buckets to dedicated, CVE-specific rules. That's great news if you're running a WordPress site on Cloudflare's free plan.

One nuance, though: of the 3 new "JS Bracket Concat Obfuscation" XSS detections, only the URI variant ships as Block — the Body and Headers variants are added as Disabled. Sounds like those are starting out in a watch-and-wait mode.

Dive Deep

The original rule table reveals a bit more detail.

  • SSRF - Restricted Protocol / SSRF - Obfuscated Host: both new detections, Log → Block
  • LFI - Path Traversal: new detection, Log → Block
  • Adobe ColdFusion - File Upload Path Traversal (CVE-2026-48276) / Adobe ColdFusion - Path Traversal (CVE-2026-48282): both new detections, Log → Block
  • XSS - JS Bracket Concat Obfuscation (Body / Headers / URI): all 3 are new detections, but only URI is Block — Body and Headers are Disabled
  • Wordpress - SQL Injection (CVE-2026-60137) / Wordpress - Remote Code Execution (CVE-2026-63030): added as Block to both the Managed Ruleset and Free Ruleset; each was previously handled under the generic "Generic Rules - SQLi" / "Generic Rules - Unauthenticated RCE" labels
  • Generic Rules - RCE / Generic Rules - Auth Bypass - 2 / Generic Rules - Information Disclosure: all new Block rules
  • Generic Rules - Command Execution (Body / Header / URI, all Beta): 3 previously Disabled detections were removed in this release

The original post doesn't explain why those 3 Beta rules were removed. It's possible their role got absorbed by the newly added Generic Rules - RCE and similar rules, but since that's not stated in the source, I'll leave it as my own speculation.

Wrap-up

  • A WAF release dated 2026-07-21 landed in the Cloudflare Managed Ruleset
  • Both Adobe ColdFusion path traversal flaws (CVE-2026-48276 / CVE-2026-48282) were promoted from Log to Block
  • The WordPress SQL injection (CVE-2026-60137) and RCE (CVE-2026-63030) now have dedicated Block rules in both the Managed Ruleset and Free Ruleset
  • Generic SSRF and LFI detections were also promoted to Block, alongside new emergency generic rules for RCE, auth bypass, and information disclosure
  • Meanwhile, 2 of the 3 new XSS detections are still Disabled, and 3 old Command Execution (Beta) rules were removed
  • If you use Cloudflare's WAF — Managed or Free — especially for a WordPress site or Adobe ColdFusion deployment, this release is worth a look

Related posts