CVE-2026-97075 Overview
CVE-2026-97075 is a missing authorization vulnerability in the WP Rocket plugin for WordPress, developed by WP Media. The flaw stems from incorrectly configured access control security levels and affects all versions of WP Rocket prior to 3.23.5. An unauthenticated remote attacker can reach protected plugin functionality over the network without any user interaction. The weakness is tracked under CWE-862: Missing Authorization.
Critical Impact
Unauthenticated attackers can invoke WP Rocket functionality that should require privileged access, leading to limited confidentiality and integrity impact on affected WordPress sites.
Affected Products
- WP Media WP Rocket plugin for WordPress
- All WP Rocket versions prior to 3.23.5
- WordPress sites with the vulnerable plugin active
Discovery Timeline
- 2026-10-09 - CVE-2026-97075 published to NVD
- 2026-10-09 - Last updated in NVD database
Technical Details for CVE-2026-97075
Vulnerability Analysis
The vulnerability is a broken access control issue in the WP Rocket caching plugin. One or more plugin actions do not verify the caller's capability or role before executing privileged operations. An unauthenticated attacker sending crafted HTTP requests to the vulnerable endpoints can trigger those actions.
The CWE-862 classification confirms the root issue: a security check that should be present is missing entirely. Exploitation requires no authentication, no user interaction, and only low attack complexity over the network. According to the Patchstack WP Rocket Vulnerability advisory, the impact is limited to confidentiality and integrity, with no direct availability impact. The current EPSS probability is 0.159%.
Root Cause
The root cause is incorrectly configured access control security levels within the plugin. Specific handler functions reachable through WordPress AJAX, REST, or admin-post endpoints lack a current_user_can() capability check or a nonce verification sufficient to restrict them to authorized administrators.
Attack Vector
The attack vector is network-based. An attacker issues HTTP requests to the WordPress site hosting a vulnerable WP Rocket installation. Because the vulnerable endpoints do not enforce authorization, requests from anonymous users succeed. Refer to the Patchstack advisory for additional technical details.
// No verified public proof-of-concept is available for CVE-2026-97075.
// Technical details are described in prose above. See the Patchstack advisory.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-97075
Indicators of Compromise
- Unauthenticated POST or GET requests to WP Rocket plugin endpoints under /wp-admin/admin-ajax.php or /wp-json/ paths referencing wp-rocket or rocket actions.
- Unexpected modifications to cache configuration, cache purges, or plugin option changes without a corresponding administrator session in access logs.
- HTTP 200 responses to anonymous requests targeting WP Rocket action handlers that normally require administrative privileges.
Detection Strategies
- Review web server and WordPress audit logs for requests to WP Rocket endpoints that originate without a valid authenticated session cookie.
- Enumerate installed WordPress plugins and confirm the WP Rocket version is 3.23.5 or later across all sites in the environment.
- Correlate cache invalidation events and plugin option updates with the identity of the acting user to detect anomalous unauthenticated activity.
Monitoring Recommendations
- Deploy a Web Application Firewall rule to alert on anonymous access to WP Rocket admin-ajax and REST actions.
- Monitor WordPress options table changes tied to WP Rocket keys and alert on modifications outside administrator sessions.
- Forward WordPress and web server logs to a centralized analytics platform for retention and query-based threat hunting.
How to Mitigate CVE-2026-97075
Immediate Actions Required
- Upgrade WP Rocket to version 3.23.5 or later on every WordPress site in the environment.
- Audit administrator and editor accounts for unexpected changes to plugin configuration or cache state.
- Rotate WordPress secrets in wp-config.php if evidence of unauthorized plugin interaction is found.
Patch Information
WP Media addressed CVE-2026-97075 in WP Rocket 3.23.5. Upgrade through the WordPress plugin updater or by replacing the plugin files with the fixed release. Confirm the fixed version is reported under the WordPress admin plugins page after update. See the Patchstack WP Rocket Vulnerability advisory for the vendor-coordinated fix reference.
Workarounds
- Deactivate the WP Rocket plugin until the site can be upgraded to version 3.23.5.
- Restrict access to /wp-admin/admin-ajax.php and /wp-json/ WP Rocket routes with WAF rules that require authenticated sessions.
- Place the WordPress admin interface behind IP allow-listing or an authenticating reverse proxy to reduce exposure.
# Update WP Rocket using WP-CLI on affected hosts
wp plugin update wp-rocket --version=3.23.5
wp plugin get wp-rocket --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
