CVE-2026-97075: WordPress WP Rocket plugin < 3.23.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP Media WP Rocket wp-rocket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Rocket: from n/a before 3.23.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WP Rocket pluginto a version that resolves this vulnerability.Fixed in 3.23.5
Event History
Frequently Asked Questions
Which installations are affected?
WP Rocket versions before 3.23.5 are affected. The available data does not identify any unaffected configuration within those versions.
Does exploitation require an authenticated WordPress account or user interaction?
No. The vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the immediate remediation?
Update WP Rocket to version 3.23.5 or later. The provided information does not specify a mitigation for environments where updating cannot be performed immediately.
What impact can successful exploitation have?
The reported severity vector indicates low confidentiality and integrity impact, with no availability impact.