WAF rule updates for WordPress CVE-2026-65640
Updated WAF rule metadata in Cloudflare Managed Ruleset and Free Ruleset to identify CVE-2026-65640, a remote code execution vulnerability in WordPress. Rule detection and blocking behavior remain unchanged; only metadata descriptions were refined.
This release updates WordPress remote code execution rule metadata in the Cloudflare Managed Ruleset and Cloudflare Free Ruleset to identify CVE-2026-65640.
Key Findings
- CVE-2026-65640: A remote code execution vulnerability affecting WordPress core and plugin components. Remote, unauthenticated attackers can execute arbitrary system commands to gain unauthorized access or establish backdoors on host servers.
Impact
The WordPress changes update rule metadata only; detection behavior and actions remain unchanged.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...3590a4ad | N/A | Wordpress - Remote Code Execution - CVE:CVE-2026-65640 | Block | N/A | Rule metadata description refined. Detection unchanged. |
| Cloudflare Free Ruleset | ...cfe1a93c | N/A | Wordpress - Remote Code Execution - CVE:CVE-2026-65640 | Block | N/A | Rule metadata description refined. Detection unchanged. |
Source: original entry ↗
More from Cloudflare
Follow Cloudflare to get its new changes in your feed and email digest.
DNS - Configure Advanced Custom Nameservers with nameserver sets
Nameserver sets are now available in beta for Enterprise accounts, allowing you to group custom nameserver names with Cloudflare-assigned IP addresses and assign them to multiple zones. This new approach replaces legacy custom_ns sets with reusable, immutable objects that support up to 3 IPv4 and 3 IPv6 addresses per nameserver and can leverage Advanced anycast network groups for improved resiliency.
Cloudflare API MCP server sends Workers Issues as MCP Events
The Cloudflare API MCP server now exposes Workers Issues as MCP Events through webhook subscriptions, allowing agents to receive real-time notifications when production failures are detected without polling. Clients can subscribe to cloudflare.alert.workers_observability_real_time_issue scoped to an account or individual Worker.
Web Analytics: Deeper Core Web Vitals Diagnostics with LCP & INP Sub-Part Metrics
Real User Monitoring in Web Analytics now breaks down Largest Contentful Paint (LCP) and Interaction to Next Paint (INP) into their constituent phases, plus splits connection time into TCP and TLS components. These sub-part metrics are available in the dashboard and queryable through the GraphQL Analytics API to help identify which specific area is impacting page performance.