JA EN
shiichan

Emergency WAF release! Cloudflare instantly blocks WordPress and JFrog Artifactory flaws

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security

Hey everyone, it's Shii-chan! Today I found some urgent security news, so let's get a bit more serious than usual.

Cloudflare Changelog developers.cloudflare.com

What was announced?

On the Cloudflare Changelog, an emergency WAF release titled "2026-09-25 - Emergency" went out. It adds rules for immediate defense against critical vulnerabilities affecting WordPress and JFrog Artifactory, specifically path traversal, local file inclusion (LFI), cross-site scripting (XSS), and authentication bypass.

Why it matters

Here are the vulnerabilities covered:

  • CVE-2026-87902 (High severity): A path traversal / LFI vulnerability in WordPress. Unauthenticated attackers can exploit it to read arbitrary files on the host server, potentially exposing sensitive configuration data or system files.
  • CVE-2026-42018 / CVE-2026-82329 (Critical severity): Authentication bypass vulnerabilities in JFrog Artifactory. Successful exploitation lets unauthenticated attackers bypass security controls and gain unauthorized access to the Artifactory instance.

Both types can be exploited without authentication, which is the scary part, just having the affected software exposed to the internet is enough to become a target. Cloudflare strongly recommends administrators apply the latest vendor patches for WordPress and JFrog Artifactory to fully secure their origin servers.

Dive Deep

All of this release's rule changes are new detections added to the Cloudflare Managed Ruleset:

  • Wordpress - Path Traversal, Local File Inclusion - CVE:CVE-2026-87902 → new detection, action set to Block
  • Wordpress - XSS - Comment → new detection, action set to Block
  • JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-42018 → new detection, action set to Block
  • JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-82329 → new detection, action set to Block

All four are brand-new detections where no matching rule previously existed, and each one is set to block on detection. If your site has the Cloudflare Managed Ruleset enabled, these rules apply automatically without any extra configuration.

That said, WAF rules are a shield that blocks attacks, not a fix for the underlying vulnerability. If you're running WordPress or JFrog Artifactory, don't forget that applying the vendor's own patches is still required.

Wrap-up

  • Four emergency WAF rules were added against WordPress path traversal/LFI and XSS, plus JFrog Artifactory authentication bypass (2 CVEs)
  • All are unauthenticated, severe vulnerabilities, and every rule's action is Block
  • If you use the Cloudflare Managed Ruleset, the rules are enabled automatically
  • WAF rules are only a mitigation, so patching WordPress and JFrog Artifactory is still essential

If you run WordPress sites or JFrog Artifactory, now's a good time to check your patch status.

Related posts