CVE-2026-97075
MediumCVSS 6.5Summary
The WP Rocket plugin for WordPress (versions before 3.23.5) contains a Missing Authorization vulnerability caused by incorrectly configured access control security levels. This allows exploitation of improperly configured security mechanisms.
Risk Assessment
An attacker may gain access to functions or resources that should be protected, potentially leading to unauthorized changes in the site configuration.
Recommendation
Update the WP Rocket plugin to version 3.23.5 or later.
Other vulnerabilities in WP Rocket
See all- CVE-2026-97076High
Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection. This issue affects WP Rocket: from n/a before 3.23.5.
- CVE-2026-5934High
The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocket_beacon AJAX endpoint. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Original NVD description (English source)
Missing Authorization vulnerability in WP Media WP Rocket wp-rocket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Rocket: from n/a before 3.23.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS