Cloudflare deployed WAF protections for 2 critical WordPress vulns before public release: unauthenticated RCE + SQLi. If your WordPress traffic is proxied through Cloudflare, the new rules help reduce exposure while you patch. Fixes are in 7.0.2, with backports to 6.9.5, 6.8.6, and 7.1 Beta 2. Patch anyway. WAF is not a substitute for updating. https://cfl.re/4yrOFNH