Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

WP Rocket plugin lets attackers bypass access controls

CVE-2026-97075 · published 26 days ago
Summary

The WP Rocket plugin for WordPress does not properly check who is allowed to use certain features, so a malicious user could gain access to functions they shouldn’t have. This could let an attacker change settings or view data they’re not supposed to see. Update the plugin to version 3.23.5 or later as soon as possible to restore proper protection.

What to do
  • Update wp media wp rocket to version 3.23.5.
Affected software
VendorProductAffected versions
wp media wp rocket < 3.23.5
Fix: upgrade to 3.23.5
Original advisory text
WordPress WP Rocket plugin < 3.23.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP Media WP Rocket wp-rocket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Rocket: from n/a before 3.23.5.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published9 Oct 2026
Updated26 Oct 2026
First seen9 Oct 2026
Sources
CVE-2026-97075 · NVD
CVE-2026-97075 · MITRE
Track software like this
Free during beta