WAF - WAF Release - 2026-08-07

<p>This release updates WordPress XSS rule metadata in the Cloudflare Managed Ruleset and Cloudflare Free Ruleset to identify XSS2Shell (CVE-2026-64638). It also disables the Command Injection - Obfuscation rule.</p> <p><strong>Key Findings</strong></p> <ul> <li>CVE-2026-64638: A pre-authentication reflected cross-site scripting vulnerability affecting the WordPress login screen. Exploitation requires social engineering and explicit interaction by the target user. Under additional conditions, it may be escalated to remote code execution.</li> </ul> <p><strong>Impact</strong></p> <p>The WordPress changes update rule metadata only; detection behavior and actions remain unchanged.</p> <table style="width: 100%"><thead><tr><th>Ruleset</th><th>Rule ID</th><th>Legacy Rule ID</th><th>Description</th><th>Previous Action</th><th>New Action</th><th>Comments</th></tr></thead><tbody><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="d3852d0891634686a46114069c6dff1c"><button type="button" title="Copy rule ID" aria-label="Copy rule ID d3852d0891634686a46114069c6dff1c" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...9c6dff1c</span></button></span></td><td>N/A</td><td>Wordpress - XSS - CVE:CVE-2026-64638</td><td>Block</td><td>N/A</td><td>Rule metadata description refined. Detection unchanged.</td></tr><tr><td>Cloudflare Free Ruleset</td><td><span class="rule-id" data-rule-id="5bdf578fff504b8cbe3b7f699ab5ed95"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 5bdf578fff504b8cbe3b7f699ab5ed95" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...9ab5ed95</span></button></span></td><td>N/A</td><td>Wordpress - XSS - CVE:CVE-2026-64638</td><td>Block</td><td>N/A</td><td>Rule metadata description refined. Detection unchanged.</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="95a84ab1645a49c685648c17761e7a4c"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 95a84ab1645a49c685648c17761e7a4c" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...761e7a4c</span></button></span></td><td>N/A</td><td>Command Injection - Obfuscation</td><td>Block</td><td>Disabled</td><td>Detection logic has been deprecated</td></tr></tbody></table>