wordpress-security waf cve-2026 rest-api cloudflare

Cloudflare blocks two critical WordPress vulnerabilities

WAF rules now block CVE-2026-60137 (SQL injection) and CVE-2026-63030 (unauthenticated RCE in REST API batch endpoint) across free and paid plans, but patching remains mandatory.

Summary

WordPress sites get immediate WAF protection while you patch, but RCE exploits the REST API batch endpoint when persistent object cache is absent—a common configuration gap. Verify your cache setup and patch status now.

Why it matters

Implementation verdict

Replaces manual exploit monitoring on Cloudflare-proxied traffic. Requires: enable Managed Rules (Pro+) or verify Free Ruleset activation, review ruleset overrides that log instead of block, confirm WordPress patched to 7.0.2, 6.9.5, 6.8.6, or 7.1 Beta 2. Ready now but insufficient alone—patch immediately.

Sources

1.Unauthenticated remote code execution. A vulnerability in WordPress version 6.9 and later allows an unauthenticated attacker to execute code through the batch endpoint of the REST API when a persistent object cache is not in use
2.Cloudflare has deployed the new rules to protect all customers, including those on free and paid plans, as long as their application traffic is proxied through the Cloudflare WAF
3.The rules were deployed at 17:03 UTC on July 17 2026
4.These rules reduce risk while organizations update affected systems; they do not fix the underlying vulnerable code

Dev Signal

Get briefs like this in your inbox — free, every weekday.

100+ sources compressed into one 4-minute read. Ranked, cited, implementation-ready.

Read the full issue →All briefs