Cloudflare WAF Blocks Two Critical WordPress Vulnerabilities: What Site Owners Must Do
Cloudflare activated emergency WAF rules for a critical WordPress REST API RCE and a related SQL injection flaw. Here is what affected versions are, how the rules work, and the steps every site owner should follow.
Cloudflare has shipped new Web Application Firewall rules that shield WordPress sites from two freshly disclosed, high-impact flaws — an unauthenticated remote code execution bug in the WordPress REST API and a closely linked SQL injection weakness. The rules went live on July 17, 2026 at 17:03 UTC and apply to every Cloudflare customer whose traffic is proxied through the network, including accounts on free plans. Because attackers can reach the vulnerable code path without logging in or tricking a user, defenders are treating this as a priority event. Site owners who route their domains through Cloudflare already have a first line of filtering in place, but patching WordPress itself remains the only durable fix.
For background on how this protection fits into a broader defense strategy, see our guide on Cloudflare WAF WordPress vulnerabilities. The rest of this article breaks down which versions are exposed, what the rules do, and the exact checklist to run through today.
Key Takeaways
- Cloudflare deployed two WAF rules on July 17, 2026 to block attacks against a critical REST API RCE and a related SQL injection in WordPress.
- CVE-2026-63030 is rated Critical and lets unauthenticated attackers run code through the REST API batch endpoint on WordPress 6.9 and later.
- CVE-2026-60137 is rated High and allows database query manipulation on WordPress 6.8 and later through crafted input.
- WordPress has released fixes in 7.0.2, with backports in 6.9.5, 6.8.6, and 7.1 Beta 2; versions before 6.8 are not affected.
- WordPress is forcing automatic updates on impacted sites, but administrators should still confirm the patched version is live.
- Site owners on Pro, Business, or Enterprise plans should confirm that the Managed Ruleset is enabled and that no blanket Log override is disabling the new rules.
Understanding the Two Vulnerabilities
Both issues were shared with Cloudflare ahead of public disclosure so that infrastructure providers could deploy protections before exploit details spread. They sit in different layers of the request path, which is why Cloudflare pushed two distinct detection rules rather than one.
CVE-2026-63030: Unauthenticated Remote Code Execution
The most serious of the pair is an unauthenticated RCE in WordPress 6.9 and above. Attackers can reach the vulnerable REST API batch endpoint without supplying credentials or persuading a logged-in user to take action. The bug becomes exploitable when a site does not use a persistent object cache, which is the default configuration for most small and mid-sized WordPress deployments. Because the path accepts a batch of operations in a single request, a crafted payload can pivot from request handling into arbitrary code execution on the server.
CVE-2026-60137: SQL Injection
The SQL injection flaw appears in WordPress 6.8 and above. It lets a specially crafted input alter the structure of a database query, opening the door to data extraction, authentication bypass, or further compromise. The issue is closely related to the RCE; addressing the SQL injection path is part of how the RCE chain is broken.
| Identifier | Vulnerability Type | Affected Versions | Severity Rating | |
|---|---|---|---|---|
| CVE-2026-63030 | Unauthenticated remote code execution via REST API batch endpoint | WordPress 6.9 and later | Critical | WordPress 6.8 and later |
| CVE-2026-60137 | SQL injection via crafted input parameters | WordPress 6.8 and later | High | Versions below 6.8 |
How Cloudflare's WAF Rules Work
Cloudflare released two managed rules designed to intercept malicious requests before they touch WordPress core. The first rule targets crafted parameter values associated with the SQL injection, sanitizing the request earlier in the pipeline. The second rule is tuned for the remote code execution path, blocking requests that attempt to reach the vulnerable REST API batch logic. Together they cover both attack surfaces.
The rules are deployed with the default Managed Ruleset action of Block, meaning matching requests are denied outright rather than simply logged. Customers on the Free plan are protected automatically through the Free Ruleset. Users on Pro, Business, and Enterprise plans should confirm that Managed Rules are switched on and review any global overrides that might downgrade all rules from Block to Log, since an override at the ruleset level would neutralize the new protections.
Affected Versions and the Patch Rollout
WordPress shipped fixes in version 7.0.2, with backported patches in 6.9.5, 6.8.6, and 7.1 Beta 2. Sites running the 6.8 branch only need the SQL injection fix, so 6.8.6 is sufficient for those installs. Sites running 6.9 or later need both fixes, which is why 6.9.5, 7.0.2, and 7.1 Beta 2 address both CVEs. Installations older than 6.8 are not vulnerable to either issue.
Because WordPress classes this as its highest-severity, highest-priority release, it is forcing automatic background updates on affected sites. Most well-maintained installations will be patched without any action from the owner. Still, plugins, custom code, and host-level controls can delay or block an automatic upgrade, so a manual check is strongly advised.
Immediate Action Checklist for Site Owners
- Log in to the WordPress dashboard and confirm the running version is 6.8.6, 6.9.5, or 7.0.2 (or the latest 7.1 Beta 2 with the security patch).
- If the version is older, trigger an update from the Updates screen or use your host's one-click how to login to WordPress in one click using SiteCountry manager shortcut to reach the upgrade path.
- From the Cloudflare dashboard, open Security → WAF → Managed Rules and confirm the new rules are present and set to Block.
- Audit any ruleset-level overrides on the same page. A blanket Log action inherited from earlier tuning can quietly disable the new protections.
- Review Security Events for hits against either rule to gauge whether probing traffic is already arriving.
- Take a fresh backup before any update and keep a verified restore point, following how to backup WordPress website using Softaculous or your host's preferred tool.
- Practice a restore on a staging site with how to restore backup of a WordPress website using JetBackup so recovery is fast if an update goes wrong.
Layered Defense: Why WAF Rules Are Not a Substitute for Patching
Managed WAF rules buy time. They block the patterns Cloudflare's researchers have seen so far, but attackers iterate, and a future variant could slip past signatures. Patching WordPress removes the vulnerable code entirely, which is the only way to eliminate the attack surface. Treat the new Cloudflare rules as a safety net while you confirm that every site — production, staging, and developer environments — is running a patched release.
Operators who manage many sites should also audit staging and pre-production copies, since those often share credentials and infrastructure but lag behind on patches. Subscribing to the official SiteCountry WordPress security feed in our knowledge base is a low-effort way to stay ahead of the next release.
Frequently Asked Questions
Which WordPress versions are vulnerable to the REST API remote code execution flaw?
CVE-2026-63030 affects WordPress 6.9 and later. Sites on the 6.8 branch are not exposed to the RCE, though they remain vulnerable to the SQL injection tracked as CVE-2026-60137. Versions released before 6.8 are not affected by either issue.
Do free Cloudflare users receive the new protection?
Yes. The two new rules are part of the default Cloudflare WAF deployment, and free-plan customers are protected through the Free Ruleset without any manual setup. Pro, Business, and Enterprise customers should still verify that Managed Rules are enabled and that no global override has changed the action from Block to Log.
What should I do if my site is on WordPress 6.8?
Update to 6.8.6, which contains the backported SQL injection fix. The RCE does not apply to the 6.8 branch, so you do not need to jump to 7.0.2 unless you also want the broader improvements in the 7.x line.
Will WordPress update my site automatically?
Yes, in most cases. WordPress is treating this as its highest-priority security release and is forcing automatic background updates on affected installs. Plugins that block core upgrades, custom mu-plugins, or managed-host restrictions can prevent the auto-update, so confirm the running version manually.
How can I tell if attackers have probed my site?
Open the Cloudflare Security Events log and filter for hits against the new WAF rules. Block events tied to the SQL injection or REST API batch patterns indicate that someone has already tried to exploit the vulnerabilities against your domain, which is a strong reason to confirm your WordPress version right away.
Conclusion
The Cloudflare WAF now blocks known exploit patterns for both CVE-2026-63030 and CVE-2026-60137 across every customer plan, but signature-based filtering is only a temporary safety measure. Review your WordPress version today, force the update to 6.8.6, 6.9.5, or 7.0.2 if it has not already happened, and verify that the Cloudflare Managed Ruleset is enforcing Block. Combine that with a fresh backup and a tested restore path so you can recover quickly if anything goes wrong. Layered defense — patch, firewall, monitoring, and backups — is what turns an emergency into a routine maintenance task.
