WAF - WAF Release - 2026-08-17

<p>This release updates WordPress remote code execution rule metadata in the Cloudflare Managed Ruleset and Cloudflare Free Ruleset to identify CVE-2026-65640.</p> <p><strong>Key Findings</strong></p> <ul> <li>CVE-2026-65640: A remote code execution vulnerability affecting WordPress core and plugin components. Remote, unauthenticated attackers can execute arbitrary system commands to gain unauthorized access or establish backdoors on host servers.</li> </ul> <p><strong>Impact</strong></p> <p>The WordPress changes update rule metadata only; detection behavior and actions remain unchanged.</p> <table style="width: 100%"><thead><tr><th>Ruleset</th><th>Rule ID</th><th>Legacy Rule ID</th><th>Description</th><th>Previous Action</th><th>New Action</th><th>Comments</th></tr></thead><tbody><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="dcf635ab2e744e1a994443973590a4ad"><button type="button" title="Copy rule ID" aria-label="Copy rule ID dcf635ab2e744e1a994443973590a4ad" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...3590a4ad</span></button></span></td><td>N/A</td><td>Wordpress - Remote Code Execution - CVE:CVE-2026-65640</td><td>Block</td><td>N/A</td><td>Rule metadata description refined. Detection unchanged.</td></tr><tr><td>Cloudflare Free Ruleset</td><td><span class="rule-id" data-rule-id="6ad9f2049b094c608be0f8adcfe1a93c"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 6ad9f2049b094c608be0f8adcfe1a93c" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...cfe1a93c</span></button></span></td><td>N/A</td><td>Wordpress - Remote Code Execution - CVE:CVE-2026-65640</td><td>Block</td><td>N/A</td><td>Rule metadata description refined. Detection unchanged.</td></tr></tbody></table>