CVE-2026-97076: WordPress WP Rocket plugin < 3.23.5 - Denial of Service Attack vulnerability
Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WP Rocket pluginto a version that resolves this vulnerability.Fixed in 3.23.5
Event History
Frequently Asked Questions
Which deployments are affected?
WP Media WP Rocket versions before 3.23.5 are affected. The available data does not identify a configuration prerequisite or any unaffected earlier version range.
Does exploitation require authentication or user interaction?
No. The supplied CVSS vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the expected impact?
The CVSS vector indicates a high availability impact, with no stated confidentiality or integrity impact. The vulnerability is described as an executable regular expression error and is titled as a denial-of-service issue.
What should be prioritized for remediation?
Upgrade WP Rocket to version 3.23.5 or later, since versions before 3.23.5 are identified as affected. The provided data does not specify a workaround or mitigation for systems that cannot be upgraded immediately.