WP Rocket EUVD-2026-95541

Exploitation targets a WP Rocket plugin action/endpoint that is missing a proper authorization (capability) check, affecting WP Rocket versions before 3.23.5 on WordPress. The supplied CVSS vector (PR:N/UI:N) implies no authentication or user interaction is required, but the CWE-862 'Missing Authorization' classification typically means the limiting factor is possession of a valid (often low-privilege, e.g., Subscriber) WordPress account on the target site rather than fully anonymous access - this privilege prerequisite is the key limiter and is not definitively stated in the source data. Impact is bounded to partial confidentiality and integrity (no availability loss), and only sites running WP Rocket older than 3.23.5 are affected; updating to 3.23.5 or later removes the condition.

This is a moderate-risk issue that does not rise to emergency priority. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) scores 6.5 (Medium) with network reach, low complexity, and - as written - no privileges or user interaction, which would make it remotely exploitable at scale. However, the CWE-862 (Missing Authorization) classification and the description's phrasing ('Incorrectly Configured Access Control Security Levels') point to a broken-access-control flaw where an under-privileged actor reaches a function they should not; in Patchstack's WordPress dataset these typically require at least a low-privilege authenticated account (e.g., Subscriber), which conflicts with the PR:N in the supplied vector - verify the true privilege prerequisite with Patchstack/vendor before treating this as fully unauthenticated. No EPSS score, KEV listing, or POC was provided, so there is no signal of active or imminent exploitation; the impact is also limited (C:L/I:L, A:N - no availability loss, partial confidentiality/integrity only). Net: a real but non-critical hardening fix for a widely deployed plugin, to be patched on a normal cycle rather than as an out-of-band emergency.

An attacker (likely a logged-in low-privilege user, though the supplied CVSS vector marks it unauthenticated) sends a crafted request to a WP Rocket plugin endpoint that lacks a proper capability/authorization check, invoking an action reserved for higher-privilege roles. This yields limited disclosure or modification of plugin/cache settings or data (CVSS C:L/I:L) but no service disruption (A:N). No public exploit was identified at time of analysis.