Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities
Jul 17, 2026Daniele Molteni, Ah-young Choi, Georgie Yoxall, Kuber Nandwani, Vikram Grover
Summary
This post details the deployment of two new Cloudflare WAF rules to protect against CVE-2026-60137 (SQL injection) and CVE-2026-63030 (Unauthenticated RCE) in WordPress. The rules are designed to block malicious requests targeting these vulnerabilities, providing defense-in-depth while users update their WordPress installations. The SQL injection rule targets crafted parameter values, and the RCE rule targets requests to the remote code execution path. Both rules are deployed with a default 'Block' action and are available through the Managed Ruleset for Pro/Business/Enterprise plans and the Free Ruleset for free plans.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack