WAF - WAF Release - 2026-08-17

This release updates WordPress remote code execution rule metadata in the Cloudflare Managed Ruleset and Cloudflare Free Ruleset to identify CVE-2026-65640.

Key Findings

• CVE-2026-65640: A remote code execution vulnerability affecting WordPress core and plugin components. Remote, unauthenticated attackers can execute arbitrary system commands to gain unauthorized access or establish backdoors on host servers.

Impact

The WordPress changes update rule metadata only; detection behavior and actions remain unchanged.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	...3590a4ad	N/A	Wordpress - Remote Code Execution - CVE:CVE-2026-65640	Block	N/A	Rule metadata description refined. Detection unchanged.
Cloudflare Free Ruleset	...cfe1a93c	N/A	Wordpress - Remote Code Execution - CVE:CVE-2026-65640	Block	N/A	Rule metadata description refined. Detection unchanged.