Cloudflare blocks critical WordPress RCE and SQLi with new WAF rules
On July 17, Cloudflare activated WAF rules that block two high‑severity WordPress flaws—a critical unauthenticated RCE and a high‑rated SQL injection. The rules protect all customers, free and paid, while sites apply the WordPress 7.0.2 (and backports) patches.