CVE-2026-97075: Missing Authorization in WP Media WP Rocket

This vulnerability in WP Rocket involves missing authorization checks, which means that certain actions or resources can be accessed without proper permission validation. The issue affects all versions prior to 3.23.5. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

Exploitation of this vulnerability could allow an unauthenticated attacker to access or modify data that should be protected by access controls, resulting in limited confidentiality and integrity loss. There is no indication of availability impact or known active exploitation in the wild.

Upgrade WP Rocket to version 3.23.5 or later where this authorization issue is fixed. Since a fixed version is identified, applying this official patch is the recommended remediation.