techlist.io
KREN
cloudflare

Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities (opens in new tab)

cloudflarevulnerability-managementrest-apiweb-application-firewallsql-injectionwordpressremote-code-execution

Cloudflare has deployed WAF protections for two serious WordPress vulnerabilities: a high-severity SQL injection and a critical unauthenticated remote code execution flaw. The rules protect proxied WordPress sites on both free and paid Cloudflare plans, but they only reduce exposure while sites are patched. WordPress updates remain essential, with fixes available in versions 6.8.6, 6.9.5, 7.0.2, and 7.1 Beta 2.

Vulnerabilities and Affected Versions

  • CVE-2026-60137 — SQL injection
    • Affects WordPress 6.8 and later.
    • Crafted input can alter database queries.
    • Rated High.
  • CVE-2026-63030 — Unauthenticated RCE
    • Affects WordPress 6.9 and later.
    • Exploits the REST API batch endpoint when persistent object caching is not enabled.
    • Requires no authentication or user interaction.
    • Rated Critical.
  • Versions earlier than 6.8 are not affected.
  • WordPress 6.8.6 fixes the SQL injection; later listed releases fix both vulnerabilities.

Cloudflare WAF Protections

  • Cloudflare deployed the protections at 17:03 UTC on July 17, 2026.
  • Both rules are enabled with a default Block action:
    • SQL injection rule: 1c060d3a371549219ee290d7ed933fcc for Managed Rules and db003b39b7774859a8d588ce33697a1a for the Free Ruleset.
    • RCE rule: 7dfb2bd4708d4b88b9911dc0550664b6 for Managed Rules and ebd3f2df15c74ddcbf6220c9b5ec246a for the Free Ruleset.
  • The SQL injection rule blocks malicious parameter values before they reach WordPress.
  • The RCE rule targets requests attempting to access the vulnerable REST API path.

Customer Actions

  • Pro, Business, and Enterprise customers should ensure Cloudflare Managed Rules are enabled.
  • Free-plan customers receive protection automatically through the Free Ruleset.
  • Review ruleset overrides, especially configurations that change blocking to logging.
  • Monitor Cloudflare Security Events for requests matching either rule.
  • Confirm that WordPress automatic updates succeeded and that the site runs a patched release.

Ongoing Protection

Cloudflare will monitor matching traffic and refine detections as attackers develop new variations. The WAF rules provide defense in depth, but they cannot repair vulnerable WordPress code.

Administrators should patch WordPress immediately, verify that both WAF rules remain active with the Block action, and investigate suspicious requests if updating is temporarily impossible.