WP Rocket EUVD-2026-95510

Exploitable against default configurations of WP Rocket versions prior to 3.23.5 with no authentication, no user interaction, and low attack complexity (AV:N/AC:L/PR:N/UI:N) - the attacker only needs network reachability to the WordPress site. The limiting factor is impact scope: per the CVSS vector the consequence is availability loss only (C:N/I:N), i.e. a denial-of-service condition rather than data exposure or takeover. Note the description/CWE label this 'Code Injection,' which if accurate would broaden the required conditions and impact; this is unverified and conflicts with the scored vector.

Signals conflict and must be reconciled before prioritization. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remote, low-complexity, unauthenticated flaw with impact restricted to AVAILABILITY only (C:N/I:N) - i.e. a denial-of-service condition. This is corroborated by the single Patchstack reference, whose URL slug explicitly reads 'denial-of-service-attack-vulnerability.' However, the CVE Description and CWE-624 (Executable Regular Expression Error) both characterize the issue as 'Code Injection,' which would normally imply confidentiality/integrity impact - directly contradicting the C:N/I:N in the vector. This discrepancy should be resolved with the vendor/Patchstack: the quantitative data (CVSS A:H-only + reference title) strongly favors a ReDoS/availability bug rather than true code execution. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or at-scale exploitation. Net: this is a plausibly real but availability-only issue in a very widely deployed plugin; treat as a patch-soon item (especially for internet-facing WordPress sites) rather than an emergency, pending clarification of whether 'Code Injection' is accurate or a mislabel of a DoS.

An unauthenticated remote attacker sends specially crafted input to an affected WP Rocket endpoint that is processed by a vulnerable regular expression, triggering catastrophic backtracking (or injected regex evaluation) that consumes CPU/memory and renders the WordPress site unresponsive. Because AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is required against a default install. No public exploit code was identified at time of analysis.