{"id":"CVE-2026-97076","published":"2026-10-09T07:17:19.350","lastModified":"2026-10-11T13:17:31.223","description":"Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-624"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-rocket/vulnerability/wordpress-wp-rocket-plugin-3-23-5-denial-of-service-attack-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A regular expression error in WP Rocket's media handling allows attackers to inject malicious code through crafted input, potentially leading to arbitrary code execution on the WordPress site. This vulnerability is particularly concerning because it can be exploited without authentication and affects the core media processing functionality.","exploitability":"Exploitation appears moderately difficult as it requires crafting a specific regular expression pattern that triggers the error condition, but the vulnerability is remotely exploitable with no authentication required.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the WordPress server, potentially leading to full site compromise, data exfiltration, or use as a pivot point for attacking other systems in the network.","remediation":"Upgrade to WP Rocket version 3.23.5 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","wp","wordpress","media"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:23:26.600Z"}}