security.vcl breaks wordpress upgrades

[crazzy]

It is not possible to perform a wordpress upgrade with security.vcl enabled, at least the following modules are triggered while upgrading wordpress plugins:

• localfiles
• restrictedfileextensions
• xss
• sql

A sample request URL looks like this:
/wp-admin/update.php?action=install-plugin&plugin=backwpup&_wpnonce=c1e4532913

As this is a customer site being affected I can sadly not provide a live example.

[bbcamp]

Contact Pagely. Josh uses the script on WordPress successfully

[comotion]

actually, the reason I let this lie is that wordpress is notorious. yes you will have to disable loads of rules to make it upgrade. yes these rules should be on for security.

[jasonheffner]

I'd be interested in knowing what you had to do to make Wordpress run with security.vcl in place. Did you have to manually disable some rules? Can you specify exceptions to certain rules for particular pages, etc, like you can with mod_security?