Edge WAF Shields WordPress REST Endpoints from SQLi and Unauthenticated RCE — What Cloudflare Customers and Hosts Must Do

Cloudflare has pushed new Web Application Firewall (WAF) protections designed to block two high-severity attacks targeting WordPress REST API request paths: an SQL injection (SQLi) in the data layer and an unauthenticated remote code execution (RCE) that can be triggered via REST batch endpoints when a persistent object cache is not in use. The change matters to organizations running WordPress at scale because it shifts part of the risk containment to the edge—reducing window-of-exposure while patching—yet still requires timely application updates to eliminate the underlying vulnerabilities.

Meta Description: Cloudflare deploys new WAF managed rules to mitigate WordPress REST API SQL injection and unauthenticated RCE (CVE-2026-60137, CVE-2026-63030). Learn the practical patch versions, rule activation guidance, monitoring steps, and why edge enforcement complements—but never replaces—responsible DNS, TLS, and website security operations.

Executive Summary

Two newly disclosed WordPress vulnerabilities are being actively mitigated at the CDN/edge layer through Cloudflare WAF Managed Rules. Cloudflare reports that the rules were deployed at 17:03 UTC on July 17, 2026 and apply broadly to customers whose traffic is proxied through Cloudflare (including free plan users via Free Rulesets). The WAF protections provide