A WAF decides using rules, limits and parsers. An attacker looks for places where its view of the request differs from the view of the application behind it. Common techniques include encoding the payload in an unusual way, splitting it across fields, using a content type or HTTP feature that the WAF handles less well, making the request so large that inspection stops, and sending requests straight to the origin server.
Many inspection engines only read the first part of a body, for example up to a fixed number of kilobytes, because inspecting everything costs time. A payload placed after that point is never examined. This is why a WAF is a layer of defense and not a guarantee.
When a vendor says a rule mitigates a vulnerability, check what it actually covers. Some rules block one known exploit string and cannot stop an attacker who varies the request.
Do not rely on a WAF to protect unpatched software. Apply the fix, and use the WAF as an extra barrier and as a source of logs that show who is trying.