Building trust in AI agents: A production-ready evaluation framework with Amazon Bedrock AgentCoreXbow spent $40K on AI and cracked Google Chrome wide openIs Adobe Acrobat Pro’s 3-year license worth it? Here’s how it beats the subscriptionMicrosoft Surface Laptop Ultra review: A monster AI laptop with a monster priceNvidia is no longer a PC gaming company. Get used to itMeta’s Muse Spark Open now available in Amazon SageMaker JumpStartBuilding trust in AI agents: A production-ready evaluation framework with Amazon Bedrock AgentCoreXbow spent $40K on AI and cracked Google Chrome wide openIs Adobe Acrobat Pro’s 3-year license worth it? Here’s how it beats the subscriptionMicrosoft Surface Laptop Ultra review: A monster AI laptop with a monster priceNvidia is no longer a PC gaming company. Get used to itMeta’s Muse Spark Open now available in Amazon SageMaker JumpStart
↓ Pull down to refresh stories
Courses Write Login VIVietnamese Store
News Security Jul 18, 2026, 4:30 AM Views: 1,694

Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities

Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities should be explained through that lens before any broad claim is made.

Thảo Nguyên Security and Editorial Policy Editor
Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities

Cloudflare has deployed new Web Application Firewall (WAF) protections for two critical vulnerabilities affecting WordPress.

What happened

Cloudflare has deployed new Web Application Firewall (WAF) protections for two critical vulnerabilities affecting WordPress. The protections address an Unauthenticated Remote Code Execution (RCE) vulnerability in WordPress's REST API and a related SQL Injection vulnerability.

Practical impact for readers

The WordPress security team disclosed the vulnerabilities to Cloudflare before public release so that we could prepare protections for customers. Cloudflare has deployed the new rules to protect all customers, including those on free and paid plans, as long as their application traffic is proxied through the Cloudflare WAF. The rules were deployed at 17:03 UTC on July 17 2026.

Details worth verifying

WAF protections reduce exposure while customers update, but they are not a substitute for patching. WordPress has released fixes in version 7. 0. 2, with backports to affected earlier branches: 6. 9. 5, 6. 8. 6, and 7. 1 Beta 2 ( see release details ). Versions earlier than 6. 8 are not affected. WordPress is treating this as its highest-severity, highest-priority class of issue and is forcing automatic updates to affected sites, so most sites will be updated automatically. We still recommend confirming that you are on a patched release or the backports for your branch and follow the guidance in the official WordPress security release announcement .

Who should act or wait

Cloudflare customers running WordPress sites on Pro, Business, or Enterprise plans should ensure that Cloudflare Managed Rules are enabled. Customers can follow the steps in our WAF Managed Rules documentation . Customers on free plans are automatically protected through the Free Ruleset.

What is still unclear

The new rules are deployed with the default Managed Ruleset action of Block. Customers running WordPress sites should review any ruleset-level overrides, including those that change all rules from Block to Log, and ensure the new rules use the recommended action while they update WordPress. Cloudflare customers should also monitor Security Events for requests matching either rule.

Source notes

Cloudflare Blog

Related stories

SecurityGet your Galaxy S26: Samsung rolls out an October patch for lingering security issuesSecurityLet's Encrypt cuts certificate lifetimes to 64 days starting February 2027SecurityTrack organization-wide security risk in one dashboard