NASA’s new dark energy space telescope can also detect killer asteroids
technologyreview.com·3h ago
Security
Cloudflare Blog·18d ago·5 min read
Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities
TL;DR
Cloudflare has implemented new Web Application Firewall (WAF) protections against two critical vulnerabilities in WordPress, including an Unauthenticated Remote Code Execution (RCE) and an SQL Injection. These protections were deployed to all customers on July 17, 2026, following a disclosure from the WordPress security team.
✦ Why It Matters
Update your WordPress installations to the latest versions to ensure protection against these vulnerabilities.
Key Takeaways
- Update WordPress to version 7.0.2 or apply backports immediately.
- Verify that Cloudflare WAF rules are active and set to block.
- Monitor Security Events for suspicious requests to the REST API.
- Review and adjust any ruleset-level overrides in Cloudflare.
How It Works
Cloudflare's WAF rules detect and block requests associated with the SQL injection and remote code execution vulnerabilities. The SQL injection rule intercepts crafted input before it reaches the WordPress application, while the RCE rule targets requests attempting to exploit the REST API.
This dual-layer defense helps mitigate risks during the update process.