Some example rules for CloudFlare firewall: https://developers.cloudflare.com/firewall/cf-firewall-rules/fields-and-expressions
(http.request.uri.path contains "/wp-content/" and http.request.uri.path contains ".php") or (http.request.uri.path contains "/wp-includes/" and http.request.uri.path contains ".php") or (http.request.uri.path eq "/xmlrpc.php") or (http.request.uri.path contains "wp-config")