Cloudflare has deployed two new WAF rules to shield all customers from recently disclosed high-severity vulnerabilities in WordPress. The vulnerabilities were reported to Cloudflare by the WordPress security team, and the rules are now active for all Cloudflare users running affected versions of WordPress.
- Two new WAF rules (IDs
100589and100590) have been added to mitigate the vulnerabilities. These rules are automatically enabled for all Cloudflare customers, blocking exploitation attempts without requiring manual configuration. - The first vulnerability (CVE not specified) affects WordPress core prior to version 6.5.2, enabling an attacker to perform Stored Cross-Site Scripting (XSS) via injected HTML comments.
- The second vulnerability targets the Smush plugin (versions 3.9.10 and earlier), allowing Remote Code Execution (RCE) via a malicious request to the plugin's
ajaxendpoint. - While the WAF rules provide an immediate defense, Cloudflare strongly emphasizes that customers must update WordPress to version 6.5.2 or later and the Smush plugin to version 3.9.11 or later to fully address the underlying issues.
- No other details about the vulnerabilities (e.g., CVSS scores, specific PoC) have been publicly disclosed by the WordPress security team, but Cloudflare's rules target the identified attack patterns.
For developers, this highlights the critical role of Web Application Firewalls in providing a safety net against zero-day or unpatched vulnerabilities. Even with a WAF in place, it is essential to keep software up-to-date. The WAF rules buy time for patching, but they are not a substitute for a proper update. Developers should prioritize testing and deploying the latest WordPress and plugin versions, as the WAF may not block all exploitation variants. Additionally, this incident underscores the value of layered security: combining a WAF with regular updates, input validation, and security plugins.
Source: https://blog.cloudflare.com/wordpress-vulnerabilities/