Cloudflare has deployed Web Application Firewall protections to block two high-severity vulnerabilities discovered in WordPress: an unauthenticated remote code execution issue and an associated SQL injection flaw. The protections went live on July 17, 2026, and are intended to limit attack surface while site operators apply WordPress updates or backports.
What was disclosed
Security teams found two interrelated vulnerabilities in recent WordPress releases. CVE-2026-60137 is a SQL injection bug present in WordPress 6.8 and later that can allow specially crafted input to influence a database query. CVE-2026-63030 is an unauthenticated remote code execution (RCE) vulnerability that affects WordPress 6.9 and later; it can be triggered through the REST API batch endpoint when a persistent object cache is not in use. Because the RCE can be exploited without authentication, it was classified as Critical, while the SQL injection was rated High.
Cloudflare’s mitigation and scope
Cloudflare created two detection rules and deployed them at 17:03 UTC on July 17, 2026. The protections are active for any customer whose application traffic is proxied through Cloudflare WAF. Free-plan sites receive protection via the Free Ruleset automatically; customers on Pro, Business, or Enterprise plans should enable the Cloudflare Managed Rules to ensure they are covered.
The rules were configured with a default action of Block to stop exploit attempts. The relevant rule identifiers are:
- WordPress – SQL Injection – CVE-2026-60137: Managed Ruleset ID 1c060d3a371549219ee290d7ed933fcc, Free Ruleset ID db003b39b7774859a8d588ce33697a1a
- WordPress – Remote Code Execution – CVE-2026-63030: Managed Ruleset ID 7dfb2bd4708d4b88b9911dc0550664b6, Free Ruleset ID ebd3f2df15c74ddcbf6220c9b5ec246a
Operators should verify that they have not globally overridden the WAF behavior (for example, switching all rules from Block to Log), since such changes could leave sites unprotected against these threats.
Patching and recommended actions
Cloudflare and WordPress both emphasize that WAF protections are a mitigation to reduce exposure and are not a substitute for applying software updates. WordPress published fixes in version 7.0.2, with backports provided for affected earlier branches: 6.9.5, 6.8.6, and 7.1 Beta 2. The SQL injection is present beginning in 6.8, while the RCE only appears in 6.9 and later, which is why 6.8.6 addresses the SQLi only. Versions earlier than 6.8 are not affected.
WordPress classified these issues at the highest severity and priority level and is forcing automatic updates to affected sites. Site owners should still confirm their installations are on a patched release or the appropriate backport and follow the official WordPress guidance in the security release announcement.
Who needs to take action
Site administrators running WordPress should:
- Confirm their WordPress version and apply the update or backport that corresponds to their branch.
- Ensure Cloudflare proxying is enabled for their site if they rely on Cloudflare WAF protections.
- For Pro, Business, and Enterprise Cloudflare customers, verify that Managed Rules are enabled and that no ruleset-level overrides reduce protection from Block to Log.
- For free-plan users, recognize that Cloudflare applied Free Ruleset protections automatically, but still complete the WordPress update.
Context and takeaways
The combination of an unauthenticated RCE and an associated SQL injection represents a serious risk because attackers can attempt exploitation without valid accounts. Cloudflare’s prompt rule deployment aims to limit exploitation at the edge while upstream fixes propagate. Nonetheless, the definitive remediation is to run patched WordPress releases and maintain up-to-date dependency and caching configurations—specifically to ensure persistent object caches are configured where required by site architecture.
Operators should treat the WAF deployment as a useful, temporary layer of defense and prioritize applying the publisher-supplied fixes. Verifying backups, checking for post-compromise indicators, and reviewing access logs are prudent follow-ups for sites that may have been exposed prior to mitigation.
Cloudflare provides documentation for enabling and managing its WAF Managed Rules; customers are advised to consult those materials as they apply the protections and perform patching.
Source: Cloudflare Blog