Cloudflare Blocks Critical WordPress Vulnerabilities Affecting Millions of Sites

Your WordPress site just got emergency protection from two serious security holes. Regarding WordPress vulnerabilities, Cloudflare rolled out new firewall rules on July 17, 2026, to shield sites from vulnerabilities that could let attackers run code on your server or steal your database.

Here is what happened and what it means for your business.

Two Serious Security Problems Hit WordPress

WordPress discovered two connected vulnerabilities in recent versions. The first is a SQL injection flaw that affects version 6.8 and newer. The second is even worse: an unauthenticated remote code execution vulnerability in version 6.9 and later.

The remote code execution issue (CVE-2026-63030) is particularly dangerous. An attacker does not need to log in or trick you into clicking anything. They can simply send a crafted request to your site and potentially take control. WordPress rated this as critical, their highest severity level.

The SQL injection vulnerability (CVE-2026-60137) allows someone to manipulate database queries through carefully crafted input. While less severe than the code execution flaw, it still poses a significant threat to your site and customer data.

Cloudflare Stepped In Before the News Broke

The WordPress security team gave Cloudflare advance notice of these problems. This coordination allowed Cloudflare to build and deploy protections before attackers knew the vulnerabilities existed.

Cloudflare activated two new Web Application Firewall rules at 17:03 UTC on July 17, 2026. These rules protect all customers, whether you are on a free plan or paying for service. However, your site traffic must route through Cloudflare for the protection to work.

The first rule blocks attempts to exploit the SQL injection vulnerability. The second stops requests trying to trigger the remote code execution path. Together, they catch attacks at two different stages.

WordPress Is Forcing Automatic Updates

WordPress released fixes immediately and is pushing them out automatically. Version 7.0.2 contains the patches, along with backported fixes for versions 6.9.5, 6.8.6, and 7.1 Beta 2.

If you are running WordPress 6.8 or newer, your site likely updated itself already. WordPress classified this as their highest priority issue and enabled forced automatic updates.

Good news if you are on an older version: WordPress releases before 6.8 are not affected by either vulnerability. You do not need to panic if you are still on 6.7 or earlier, though you should still keep your site updated for other security reasons.

What You Need to Do Right Now

First, check your WordPress version. Log into your dashboard and look at the bottom right corner or go to Dashboard > Updates. You want to see version 7.0.2, 6.9.5, or 6.8.6 depending on which branch you are on.

If you use Cloudflare on a Pro, Business, or Enterprise plan, verify that Managed Rules are enabled in your dashboard. Free plan users are automatically protected through the Free Ruleset.

Additionally, review any custom ruleset overrides you have configured. If you previously changed all rules from Block to Log for testing purposes, make sure these new WordPress rules are set back to Block while you confirm your site is updated.

Cloudflare Protection Is Not a Permanent Fix

The Cloudflare firewall rules reduce your risk while you update, but they are not a substitute for patching. The underlying vulnerable code still exists on your server until you update WordPress itself.

Think of the Cloudflare protection like a security guard at your door. The guard stops obvious threats, but you still need to fix the broken lock. Updating WordPress fixes the broken lock.

If you cannot update immediately for some reason, at least verify the Cloudflare rules are active and monitor your Security Events dashboard for suspicious activity targeting the REST API endpoint.

Why This Matters to Your Business

Remote code execution vulnerabilities are as bad as it gets for website security. An attacker exploiting this flaw could install malware, steal customer data, deface your site, or use your server to attack others.

The fact that no authentication is required makes it worse. Attackers do not need to breach a login or steal credentials. They just need to find your site and send a malicious request.

Therefore, WordPress and infrastructure providers like Cloudflare treated this with maximum urgency. The coordinated response, including advance notification and automatic updates, reflects how serious this threat is.

Most Sites Are Already Protected

The automatic update system means most WordPress sites received the patch within hours of release. However, some sites have automatic updates disabled for various reasons, including custom development workflows or managed hosting restrictions.

Check with your developer or hosting provider if you are uncertain about your update status. Most reputable WordPress hosts either enabled the automatic update or pushed it manually to customer sites.

Technical Details for Your Developer

The SQL injection vulnerability exists in WordPress 6.8 and later. It allows crafted input to alter database queries, potentially exposing sensitive data or allowing unauthorized database modifications.

The remote code execution vulnerability affects WordPress 6.9 and later, but only when a persistent object cache is not in use. It works through the batch endpoint of the REST API, which processes multiple requests in one call.

The relationship between these vulnerabilities suggests the SQL injection may be used as part of an exploit chain leading to code execution. Patching both is essential even if you think you are only running an affected version for one.

Moving Forward

Cloudflare will continue monitoring traffic patterns and updating the detection rules as new attack variations emerge. Security is an ongoing process, not a one-time fix.

This incident demonstrates why keeping WordPress updated matters so much. The platform is secure when patched, but running outdated versions exposes you to known vulnerabilities that attackers actively exploit.

If this security scare has you concerned about keeping up with WordPress maintenance, consider a care plan that includes automatic updates, security monitoring, and expert support. Your job is running your business, not watching for security bulletins.

For now, verify your WordPress version is current, confirm any Cloudflare protections are active, and keep an eye on your Security Events for unusual activity. Your site is likely already protected, but checking takes five minutes and gives you peace of mind.

Original Source: blog.cloudflare.com