TI-2026-69868 Aliases CVE-2026-97076 GHSA-cvhh-7x6j-w7v5

Code injection in WordPress WP Rocket plugin

LOW 39CWE-624Published 2026-10-09 · Updated 2026-10-11

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

WP Media's WP Rocket plugin versions before 3.23.5 contain an executable regular expression error (CWE-624) that allows code injection. An unauthenticated remote attacker can trigger it without user interaction, with high impact on availability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00282 20th percentileScored 2026-11-07

Fix Fixed WP Rocket (WP Media): 3.23.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
WP Media	WP Rocket	before 3.23.5	3.23.5	Patch available	CNA

WP Rocket VendorWP Media Affected before 3.23.5 Fixed in 3.23.5 Patch available CNA

Remediation

Update WP Rocket to 3.23.5, the fixed version listed for the affected product.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA WP Rocket (WP Media) Fixed in 3.23.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-09
WP Rocket 3.23.5
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-69877 Missing authorization in WordPress WP Rocket pluginPriority LOW 34
Show all 2 records →

Timeline

2026-10-09 Threatist record created from CVE-2026-97076
2026-10-09 Alias added: GHSA-cvhh-7x6j-w7v5
2026-10-10 Priority changed: MEDIUM → LOW
2026-10-11 CISA SSVC decision points changed

References

Other 1

https://patchstack.com/database/wordpress/plugin/wp-rocket/vulnerability/wordpress-wp-rocket-plugin-3-23-5-denial-of-service-attack-vulnerability?_s_id=cve

TI-2024-03858 Search & Replace < 3.2.2 - Admin+ SQL injection CVSS 3.1HIGH 7.2
TI-2024-25993 WordPress Search & Replace plugin <= 3.2.2 - Deserialization of untrusted data vulnerability CVSS 3.1CRITICAL 9.8
TI-2023-05067 BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal CVSS 3.1HIGH 8.7
TI-2026-05204 Cross-site scripting in WP Rocket CVSS 3.1HIGH 7.2
TI-2026-05464 BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter CVSS 3.1HIGH 7.2
TI-2026-69877 Missing authorization in WordPress WP Rocket plugin CVSS 3.1MEDIUM 6.5

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences