Cloudflare deploys WAF protections for critical WordPress vulnerabilities
New firewall rules mitigate two high-severity security flaws
1Critical WordPress vulnerabilities identified
Cloudflare detected unauthenticated remote code execution (RCE) and SQL injection vulnerabilities in WordPress's REST API, affecting versions 6.8 and later. The WordPress security team collaborated with Cloudflare to develop protections before public disclosure, enabling preemptive defense measures.
2Cloudflare's immediate response
New WAF rules were deployed on July 17, 2026 at 17:03 UTC, automatically protecting all Cloudflare customers including free plan users. The rules are designed to detect attack attempts at two different points in the request path, providing layered protection.
3Technical details of the vulnerabilities
CVE-2026-60137 allows SQL injection in WordPress 6.8+, while CVE-2026-63030 enables unauthenticated RCE via the REST API batch endpoint when persistent object cache isn't used. WordPress classified these as highest-priority issues requiring immediate attention.
4WordPress's patching approach
Fixes were released in version 7.0.2 with backports to 6.9.5, 6.8.6 and 7.1 Beta 2. WordPress is forcing automatic updates for affected sites, though manual verification is recommended. Versions prior to 6.8 remain unaffected by these vulnerabilities.
5Recommendations for enterprise users
Pro, Business and Enterprise plan customers should verify Cloudflare Managed Rules are enabled. While WAF rules reduce risk temporarily, updating WordPress remains the definitive solution. If immediate updates aren't possible, monitor security events and REST API endpoint access.
6Importance of industry collaboration
Cloudflare commended WordPress's coordinated vulnerability disclosure with infrastructure providers. Such early warning systems play a critical role in protecting millions of sites from potential attacks. Cloudflare will continue monitoring for new attack variations and update detections as needed.
Original article: Cloudflare Blog — Cloudflare, WordPress için kritik güvenlik açıklarını kapattı