Cloudflare has rolled out new Web Application Firewall (WAF) rules to protect WordPress sites from two vulnerabilities disclosed by the WordPress security team ahead of public release: an unauthenticated Remote Code Execution (RCE) flaw in the REST API and a related SQL injection issue.
The WordPress team notified Cloudflare and other infrastructure providers before disclosure so protections could be prepared in advance. Cloudflare says the new rules were deployed at 17:03 UTC on July 17, 2026, and apply to all customers whose traffic is proxied through the Cloudflare WAF, including free plans.
The vulnerabilities
- CVE-2026-60137 (High): A SQL injection vulnerability present in WordPress 6.8 and later, allowing crafted input to alter a database query.
- CVE-2026-63030 (Critical): An unauthenticated RCE vulnerability affecting WordPress 6.9 and later, exploitable through the REST API’s batch endpoint when a persistent object cache is not in use. No login or user interaction is required.
Because the SQL injection bug exists from 6.8 onward but the RCE only affects 6.9 and later, the fix for version 6.8.6 addresses only the SQL injection, while 6.9.5, 7.0.2, and 7.1 Beta 2 patch both issues. Versions earlier than 6.8 are not affected.
Patches and automatic updates
WordPress has released version 7.0.2 with backports to 6.9.5, 6.8.6, and 7.1 Beta 2. WordPress is treating this as its highest-severity issue class and is forcing automatic updates on affected sites, so most installations should update without manual intervention. Site owners are still advised to confirm they are on a patched release and to follow the official WordPress security guidance.
What the WAF rules do
Cloudflare created two detection rules, one for each CVE, available in both the Managed Ruleset and the Free Ruleset, with a default action of Block. The SQL injection rule inspects crafted parameter values before they reach WordPress, while the RCE rule targets requests attempting to reach the vulnerable REST API path. Together they add detection at two separate points in the request flow.
Customers on Pro, Business, or Enterprise plans should verify Managed Rules are enabled and check for any ruleset overrides that change the default action from Block to Log. Free plan customers are automatically covered through the Free Ruleset. Cloudflare recommends monitoring Security Events for traffic matching either rule.
Patching still comes first
Cloudflare is clear that the WAF rules reduce exposure while sites update but do not fix the underlying code. Updating WordPress remains the most effective remediation. Sites that cannot update immediately should confirm both rules are active with the Block action and review logs for suspicious requests to the affected REST API endpoint.