WP Rocket: CVE-2026-97076 and CVE-2026-97075

What happened

Two vulnerabilities were published for the WP Rocket plugin: CVE-2026-97076 is described as an executable regular-expression error that can allow code injection; CVE-2026-97075 is described as a missing-authorization issue that allows bypassing intended access controls. These descriptions come from the published advisory records. [Sources: 4791, 32082, 4790, 32092]

Technical cause

The advisories classify the issues under CWEs: CVE-2026-97076 is associated with CWE-624 (executable regular expression error) and CVE-2026-97075 with CWE-862 (missing authorization / improper access control). The published records provide these classifications. [Sources: 4791, 32082, 4790, 32092]

Why it matters

Both issues are reachable over the network without authentication and require no user interaction according to the advisory metadata. CVE-2026-97076 has a CVSS v3.1 base score of 7.5 (vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicating a high impact on availability. CVE-2026-97075 has a CVSS v3.1 base score of 6.5 (vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicating low-to-moderate impact to confidentiality and integrity. The advisory records report there is no known public exploit and no known active exploitation. [Sources: 4791, 32082, 4790, 32092]

Who is affected

The advisories identify the product WP Rocket (package name: wp-rocket) as affected. Source records list the affected range as versions prior to 3.23.5. Use the plugin package metadata on your sites to determine if your installation is older than the fixed release referenced in the sources. [Sources: 4791, 32082, 4790, 32092]

Discovery and timeline

The advisories were published on 2026-10-09. The relevant source records are listed in the advisory package and NVD entries referenced in the source data. The advisories include modified timestamps in their metadata. See source items for original records. [Sources: 4791, 32082, 4790, 32092]

Affected versions

Source records indicate the issues affect WP Rocket releases before 3.23.5; the package metadata and claim entries list a fix event at 3.23.5. The advisories' structured data identify 3.23.5 as the fixed version. [Sources: 4791, 32082, 4790, 32092]

Fixes and mitigation

Package entries and affected-range claims in the source data list a fix event at version 3.23.5. However, the advisory metadata field 'fix_available' is set to false in both advisory records, creating an inconsistency in the source package. We cannot confirm from the provided data whether an update is published and distributed or whether the fix is otherwise available. [Sources: 4791, 32082, 4790, 32092]

Recommended action

Check your WP Rocket installations and the plugin update channel for the vendor update referenced as 3.23.5. If your installations are older than the fixed release reported in the sources, apply the vendor update 3.23.5 when it is confirmed available. Because the advisory metadata is inconsistent about fix availability, verify the update’s presence from the vendor or trusted distribution channels before deploying. [Sources: 4791, 32082, 4790, 32092]