Cloudflare Rolls Out WAF Rules to Protect WordPress Against Two Dangerous Vulnerabilities

Cloudflare has announced the deployment of two new rules in its web application firewall (WAF) in response to high-severity vulnerabilities discovered in WordPress. Information about these vulnerabilities was passed to Cloudflare by the WordPress security team.

The new WAF rules are applied automatically to all Cloudflare customers running vulnerable versions of WordPress, and they are intended to reduce the risk of exploitation before site administrators have a chance to install the fixes.

Updating Remains Mandatory

Despite the rollout of the protective rules, Cloudflare stresses that customers still need to update WordPress to the patched version as soon as possible. The WAF rules are regarded as a temporary protective measure, not a replacement for the official patch.

The brief announcement does not disclose details about the nature of the vulnerabilities themselves — it mentions only their high severity and the fact that the information about them came from the WordPress security team.

Cloudflare's move reflects a practice in which major infrastructure providers receive information about vulnerabilities before they are publicly disclosed and are able to prepare network-level protection even before the corresponding patches become available to the wider user base.

Source: Cloudflare Blog