Cloudflare WAF Adds Block Rules for WordPress LFI and JFrog Artifactory Auth Bypass

Cloudflare has introduced four new Managed Ruleset entries that automatically block traffic exploiting a high‑severity WordPress path‑traversal/LFI bug (CVE‑2026‑87902), a WordPress comment XSS vector, and two critical authentication‑bypass flaws in JFrog Artifactory (CVE‑2026‑42018 and CVE‑2026‑82329). These edge‑level blocks give engineers immediate mitigation while the underlying applications still require vendor patches.

New Edge Rules Overview

• WordPress – Path Traversal / LFI (CVE‑2026‑87902): New rule 64bcec36a74e445891d08a9870a43f96 set to Block. No prior action existed.
• WordPress – Comment XSS: New rule 755ce44008cd482a964cb96e909a4db4 set to Block. No prior action existed.
• JFrog Artifactory – Authentication Bypass (CVE‑2026‑42018): New rule 76f7d07e2ff549789ab222cac797ef03 set to Block. No prior action existed.
• JFrog Artifactory – Authentication Bypass (CVE‑2026‑82329): New rule c6dafaadb861478dbca81469a813ac74 set to Block. No prior action existed.

Operational Impact

Enabling these rules changes the default response for matching requests from “allow” to an immediate block at Cloudflare’s edge. For teams that already route traffic through Cloudflare, the change is transparent: malicious payloads are dropped before reaching origin servers, reducing the risk of data exposure or unauthorized access. However, the new blocks can also generate false positives if legitimate traffic matches the signatures. Practitioners should monitor WAF logs for unexpected 403 responses, adjust rule scopes if needed, and verify that legitimate application functionality remains intact.

The source also advises applying the latest vendor patches for WordPress and JFrog Artifactory. Edge blocking does not replace host‑level remediation; it merely buys time while patch cycles complete. Failure to patch leaves the origin vulnerable to any request that bypasses the WAF, such as internal traffic or requests from trusted IP ranges that may be exempt from WAF inspection.

Architectural Considerations

These rules reinforce the defense‑in‑depth model where the WAF acts as the first line of inbound protection. The protection is limited to HTTP/HTTPS request inspection; it does not enforce authentication or authorization beyond the pattern match. Consequently, teams should continue to enforce proper IAM controls, TLS termination, and backend hardening. The new rules also illustrate the importance of keeping the Managed Ruleset up to date; Cloudflare can push critical signatures without requiring manual rule authoring.

For environments that use custom rule sets or have WAF bypasses for certain paths (e.g., health checks, internal APIs), engineers must verify that those exceptions do not inadvertently expose the newly identified vulnerabilities. Aligning edge security policies with internal security baselines helps avoid gaps where an attacker could exploit the same CVEs from a trusted network segment.

Related CloudNinjas coverage: security.

What This Means For Practitioners

• Confirm that the Cloudflare Managed Ruleset is enabled for all domains serving WordPress or JFrog Artifactory.
• Validate that the four rule IDs listed above are present and set to Block in the WAF configuration.
• Review WAF logs for 403 responses related to these signatures and adjust any custom allow‑lists that may be overly permissive.
• Prioritize applying the official WordPress and JFrog Artifactory patches to eliminate the underlying vulnerabilities.
• Incorporate the new rule IDs into any automated compliance or monitoring dashboards to ensure continued coverage.