CVE-2026-97076
HighCVSS 7.5Summary
Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection. This issue affects WP Rocket: from n/a before 3.23.5.
Risk Assessment
Code injection may allow an attacker to execute arbitrary code in the context of the WordPress application, potentially leading to full site takeover. The risk is high as it can result in data loss and unauthorized access.
Recommendation
Update the WP Rocket plugin to version 3.23.5 or later. Verify WordPress file integrity and review logs for suspicious activity.
Other vulnerabilities in WP Rocket
See all- CVE-2026-97075Medium
The WP Rocket plugin for WordPress (versions before 3.23.5) contains a Missing Authorization vulnerability caused by incorrectly configured access control security levels. This allows exploitation of improperly configured security mechanisms.
- CVE-2026-5934High
The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocket_beacon AJAX endpoint. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Original NVD description (English source)
Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS