JA EN
shiichan

Cloudflare WAF now spells out the dangerous WordPress RCE vulnerability by name!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security

Hey everyone, it's me, Shii-chan! Today I've got a security update that's subtle but worth knowing about.

Cloudflare Changelog developers.cloudflare.com

What was announced?

On the Cloudflare Changelog, they announced an update to rule metadata in the WAF's (Web Application Firewall) Managed Ruleset and Free Ruleset. The rule in question detects a WordPress remote code execution (RCE) vulnerability, CVE-2026-65640.

The story so far

This rule already detected and blocked remote code execution attempts against WordPress core and plugin components, but its description didn't reference a specific CVE number. With this update, the rule's description now reads "Wordpress - Remote Code Execution - CVE:CVE-2026-65640," making the exact CVE it targets clear at a glance.

What changes

The blocking logic and behavior itself doesn't change with this update. Cloudflare states directly that "detection behavior and actions remain unchanged." Only the description text was refined. That said, when you're looking at event logs in the dashboard, you'll now be able to immediately tell which vulnerability triggered a given block, which should save security teams time when investigating incidents.

Dive Deep

CVE-2026-65640 is a remote code execution vulnerability in WordPress core and plugin components. Unauthenticated, remote attackers can execute arbitrary system commands, potentially gaining unauthorized access or planting backdoors on the host server.

Two rules had their metadata updated:

  • Cloudflare Managed Ruleset (rule ID ending in 3590a4ad)
  • Cloudflare Free Ruleset (rule ID ending in cfe1a93c)

Both keep their existing Block action. If your WordPress site sits behind Cloudflare, including on the Free plan, you're automatically covered by this rule without doing anything.

Wrap-up

  • Cloudflare updated the metadata for the WAF rule in both the Managed and Free rulesets that detects the WordPress RCE vulnerability CVE-2026-65640
  • The detection logic and blocking behavior are unchanged — only the rule description now spells out the CVE number
  • The rule still uses the Block action, and it's available on the Free plan too
  • If your WordPress site runs behind Cloudflare, you're already protected without any action needed

Related posts