What Cloudflare’s New WAF Rules Mean for WordPress Sites

On July 17, 2026, Cloudflare silently deployed two emergency Web Application Firewall (WAF) rules to block what security researchers are calling the most dangerous WordPress vulnerability chain in years. If your WordPress site sits behind Cloudflare, you were protected before you even knew there was a problem. But that protection is a stopgap, not a permanent fix.

The vulnerabilities, nicknamed wp2shell by the security community, let an unauthenticated attacker execute code on your WordPress server without logging in, clicking a link, or interacting with you in any way. No username, no password, no phishing email required. Just a crafted HTTP request.

In this guide, I will walk you through exactly what these new WAF rules do, what they do not do, how to check that your site is protected, and the five actions you still need to take right now. If you run a WordPress site, this is not optional reading.

What Are Cloudflare’s New WAF Rules?

On July 17, 2026, at 17:03 UTC, Cloudflare deployed two Web Application Firewall rules designed to block a pair of vulnerabilities disclosed privately by the WordPress security team before any public announcement. The coordinated disclosure meant that by the time you heard about the issue, the WAF rules were already live and blocking attacks.

CVE-2026-60137: SQL Injection (High Severity)

A SQL injection vulnerability affecting WordPress version 6.8 and later. An attacker can craft input that alters database queries, potentially reading or modifying sensitive data from your WordPress database, including user accounts, post content, and site configuration.

CVE-2026-63030: Unauthenticated Remote Code Execution (Critical Severity)

This is the one that kept security teams up at night. WordPress version 6.9 and later contains a vulnerability in the batch endpoint of the REST API that allows an unauthenticated attacker, no login, no user interaction required, to execute arbitrary code on your server. It works when a persistent object cache is not in use, which covers the vast majority of small to medium WordPress sites. This vulnerability is directly related to the SQL injection described above, meaning an attacker could chain the two together for a complete site takeover.

Both rules were deployed with a default action of Block across every Cloudflare plan, free tier included. The rules inspect incoming requests at two different points: the SQL injection rule catches crafted parameter values before they reach WordPress, while the RCE rule blocks requests attempting to hit the vulnerable code path on the REST API batch endpoint.

Here are the specific rule IDs so you can find them in your Cloudflare dashboard:

WordPress has released fixes: version 7.0.2 is the primary patch, with backports to 6.9.5, 6.8.6, and 7.1 Beta 2. Versions earlier than 6.8 are not affected. WordPress is treating this as its highest severity class of issue and is forcing automatic security updates to all affected sites.

What the Rules Mean for Your WordPress Site

If your site traffic is proxied through Cloudflare, meaning your DNS records show the orange cloud icon, you are already protected. Every incoming request is inspected against these two rules, and anything matching known attack patterns is blocked at Cloudflare’s edge before it reaches your WordPress installation.

This is significant because the RCE vulnerability requires nothing from you or your visitors. No clicking suspicious links. No installing a compromised plugin. No phishing your login credentials. An attacker simply sends a carefully crafted request to your site’s REST API, and if your site is vulnerable, they own it. The Cloudflare rules stop that request at the network edge, before it ever touches your server.

But here is the part most people get wrong: these WAF rules reduce exposure. They do not eliminate the vulnerability. Cloudflare’s own language is specific and unambiguous: the rules “reduce exposure while customers update, but they are not a substitute for patching.”

Think of it like this. The WAF rule is a bouncer at the door who knows exactly what yesterday’s unwanted guests looked like. He will catch anyone matching that description. But if someone shows up with a different approach, one that does not match the known signature, the bouncer waves them through. Only the WordPress software update actually fixes the broken lock on the door.

Free Plans vs. Paid Plans

If you are on the Cloudflare free plan, the rules are applied automatically through the Free Managed Ruleset. There is nothing you need to enable or configure.

If you are on a Pro, Business, or Enterprise plan, you are protected through the Cloudflare Managed Ruleset. You should verify that Cloudflare Managed Rules are enabled in your WAF settings. Pro and above customers can also customize rule actions, so check that you have not accidentally overridden these rules from Block to Log or Disable.

The July 21 WAF Release

On July 21, 2026, Cloudflare released a broader WAF update introducing new rules for WordPress, Next.js, and Adobe ColdFusion vulnerabilities, plus enhanced generic protections against SSRF, LFI, and XSS. While less urgent than the July 17 emergency deployment, this update further strengthens the shield between attackers and your site. The same principle applies: the WAF catches known patterns, but keeping your software updated remains essential.

How to Check That Your Site Is Protected

Want to confirm the rules are actually active on your site? Here is a step by step verification you can complete in under two minutes.

Step 1: Log Into Your Cloudflare Dashboard

Go to dash.cloudflare.com and select your WordPress site from the domain list.

Step 2: Navigate to the WAF Section

Click Security in the left sidebar, then select WAF from the dropdown. This is where your managed rules and custom rules live.

Step 3: Check Managed Rules Status

Under the Managed Rules tab, look for “Cloudflare Managed Ruleset.” It should say Enabled. Free plan users will see the Cloudflare Free Managed Ruleset, also enabled by default.

Step 4: Search for the Specific Rule IDs

Scroll through the Managed Rules or use the search bar inside that section. Search for the IDs listed in the table above: 1c060d3a371549219ee290d7ed933fcc and 7dfb2bd4708d4b88b9911dc0550664b6 for managed rules, or db003b39b7774859a8d588ce33697a1a and ebd3f2df15c74ddcbf6220c9b5ec246a for the free ruleset. Confirm the action is Block, not Log or Disable.

Step 5: Review Security Events

Go to Security > Events. Filter by the two rule IDs. If you see blocked requests, the rules are actively catching attacks. If you see nothing, no worries, that just means your site has not been targeted by these specific exploits yet. The rules are still active and waiting.

Step 6: Verify Your DNS Proxy Status

Back in the DNS settings, confirm your domain records show the orange cloud icon, not gray. A gray cloud means traffic bypasses Cloudflare entirely, and the WAF cannot see or protect it.

If you use a managed WordPress host like Kinsta with its built in Cloudflare integration, your traffic is already routed through Cloudflare’s network at the edge. For sites that rely on a security plugin alone, our Cloudflare vs Wordfence comparison walks through how a WAF and a security plugin work together, and where each one shines.

What You Still Need to Do Right Now

The WAF rules buy you time. Here is how to make the most of it.

1. Update WordPress Immediately

If your site has not auto updated yet, update manually now. Go to Dashboard > Updates in your WordPress admin. If an update to 7.0.2 or newer is available, click Update Now. If you are on 6.8.x, update to at least 6.8.6. If you are on 6.9.x, update to at least 6.9.5. Your current version is displayed at the bottom right of every admin screen.

WordPress is forcing automatic updates for this security release, but not every hosting environment respects forced auto updates. Some managed hosts control core updates separately. Some sites have auto updates disabled via wp-config.php. Do not assume it happened. Check.

2. Update All Plugins and Themes

While you are in the Updates screen, apply every pending plugin and theme update. The wp2shell vulnerabilities are in WordPress core, not plugins, but keeping everything current reduces your overall attack surface. An outdated plugin with its own vulnerability combined with a patched core is still a problem.

3. Verify the Auto Update Actually Ran

Look at the version number in your admin footer. If it is not 7.0.2 or a patched backport, something blocked the update. Common causes: file permissions set too restrictively, auto updates disabled via define(‘WP_AUTO_UPDATE_CORE’, false) in wp-config.php, or a managed host that handles core updates on its own schedule. If WordPress 7.1 is on the horizon, understanding what each WordPress release changes helps you plan updates rather than scrambling when security patches drop.

4. Monitor Your Security Events Log

Spend five minutes reviewing your Cloudflare Security Events log. Filter by the two rule IDs. If you see blocked attempts, attackers are actively scanning for vulnerable sites, which they absolutely are. Take it as a reminder of why staying updated matters, and consider tightening other security layers too.

5. Keep the WAF Rules Enabled After Updating

Some site owners disable managed rules after patching because they assume the rules are no longer needed. Do not do this. Attackers will continue probing for these vulnerabilities for months or years. The WAF rules catch known attack shapes regardless of whether your site is vulnerable. Layer your defenses and leave them all turned on.

Common Mistakes WordPress Site Owners Make

After covering WordPress security for a while, I have seen the same mistakes repeat every time a critical vulnerability drops. Here are the ones that apply directly to Cloudflare’s new WAF rules and the wp2shell vulnerabilities.

Assuming the WAF Makes You Fully Safe

This is the mistake. The WAF is a shield, not a fix. It blocks known attack patterns. If someone discovers a new variation tomorrow, one that does not match the existing rule signatures, the WAF will not catch it until Cloudflare updates the detection logic. The only permanent fix is the WordPress software update.

Setting Managed Rules to Log Instead of Block

I have seen site owners set all managed rules to Log because they fear false positives breaking legitimate traffic. For these specific CVE rules, keep them on Block. The chance of a legitimate visitor request matching a SQL injection or RCE exploit signature is effectively zero for normal WordPress traffic. Log mode here means you see the attack happen but do nothing about it.

Running an Old WordPress Version Because “Everything Works”

I understand the hesitation. Updating feels risky. What if a plugin breaks? What if the site goes white screen? But running WordPress 6.9.x when 7.0.2 is available means leaving a door that attackers are actively scanning for. The risk of staying unpatched on a vulnerability this severe dwarfs the risk of a routine update.

Ignoring Security Events in Cloudflare

The Security Events log is not a curiosity, it is an early warning system. If you see blocked attempts against the wp2shell rule IDs, attackers are probing your site. It means your site is on someone’s radar, and they will likely try other attack vectors. Cloudflare’s traffic control features give you visibility into exactly who is hitting your site and what they are trying.

Relying on a Single Security Layer

A WAF is one layer. A security plugin like Wordfence or Sucuri is another. Keeping WordPress, plugins, and themes updated is another. Strong passwords and two factor authentication are another. Regular off site backups are another. When these layers work together, an attack that slips past one gets caught by the next. That is defense in depth, and it is how serious site owners think about security.

FAQ

Final Thoughts

Cloudflare deploying emergency WAF rules for a critical WordPress vulnerability is not a rare event. It happens when the stakes are high enough, and the wp2shell chain, unauthenticated remote code execution with a single HTTP request, is about as high as the stakes get.

The good news: if your site is behind Cloudflare, you were protected before you even heard about the problem. That is the power of a security layer that operates at the network edge, inspecting every request before it reaches your server.

The catch: that protection is temporary by design. Attackers are already reverse engineering these vulnerabilities, and variations that bypass the current WAF signatures are only a matter of time. The window between rule deployment and new attack variants is your window to update.

Here is your sixty second action plan. Verify Cloudflare is proxying your traffic with the orange cloud. Confirm the WAF rules are active with Block action. Update WordPress to 7.0.2 or your branch’s backport, right now. If the auto update did not fire, do it manually. Then update your plugins and themes while you are at it.

Security is not about being bulletproof. It is about being a harder target than the next site. These Cloudflare WAF rules make you a much harder target. The WordPress update patches the hole entirely. Together, you are in a strong position. Stay updated, stay layered, and check your security events log at least once a month.

About The Author

Marcus Li

Marcus Li is a web designer and marketing specialist based in Vancouver, BC. After years of helping clients build their online presence, he discovered how AI tools could level the playing field for everyday entrepreneurs. He shares what actually works, no fluff, no hype.

See author's posts