JA EN
shiichan

Cloudflare's WAF Can Now Catch the New WordPress XSS "XSS2Shell"!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security#web

Hi everyone, it's Shii! Today I found a security update that landed in Cloudflare's WAF, so let me give you the quick rundown.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare published a WAF release dated August 7, 2026 in its Changelog. The release updates the metadata of the WordPress XSS detection rules in both the Cloudflare Managed Ruleset and the Cloudflare Free Ruleset so they now identify a vulnerability nicknamed "XSS2Shell" (CVE-2026-64638). At the same time, a rule that detected command injection obfuscation was disabled.

The story so far

A rule that detects reflected XSS targeting the WordPress login screen already existed, but it wasn't tied to the specific CVE-2026-64638 identifier. The command injection obfuscation rule, meanwhile, had been active with a block action all along.

What changes

The two WordPress-related rules (rule ...9c6dff1c in the Cloudflare Managed Ruleset, and rule ...9ab5ed95 in the Cloudflare Free Ruleset) only got their descriptions refined — detection behavior and actions stay the same, so nobody using those rulesets needs to change anything. The command injection obfuscation rule (...761e7a4c) in the Cloudflare Managed Ruleset, on the other hand, was switched from Block to Disabled because its detection logic had become deprecated.

Dive Deep

CVE-2026-64638 is a pre-authentication reflected XSS vulnerability affecting the WordPress login screen. According to the source, exploitation requires social engineering and explicit interaction from the target user, and under certain conditions it could escalate to remote code execution.

Here's a summary of what changed in this release:

  • Cloudflare Managed Ruleset (...9c6dff1c): refined the description of the "Wordpress - XSS - CVE:CVE-2026-64638" rule. Detection behavior unchanged
  • Cloudflare Free Ruleset (...9ab5ed95): same refinement for the WordPress XSS rule. Detection behavior unchanged
  • Cloudflare Managed Ruleset (...761e7a4c): switched the "Command Injection - Obfuscation" rule from Block to Disabled, since its detection logic was deprecated

Wrap-up

  • Cloudflare updated the metadata of its Managed and Free Ruleset WordPress XSS rules to identify CVE-2026-64638 (aka XSS2Shell)
  • Detection behavior and actions themselves haven't changed, so existing users don't need to do anything
  • The outdated command injection obfuscation detection rule has been disabled

If you run a WordPress site behind Cloudflare's Managed or Free Ruleset, this is worth keeping in the back of your mind.

Related posts