WP Rocket has three flaws a stranger can reach without logging in. Update to 3.23.5.

What the flaws are

WP Rocket, made by WP Media, speeds up WordPress sites by caching pages and deferring images and scripts. To decide which images to load first, it collects data from visitors’ browsers through an endpoint called rocket_beacon. In versions up to and including 3.21.0.1, that endpoint didn’t clean what it received before saving it, so anyone, with no login, could store a script that then runs for every visitor who loads the affected page. That is CVE-2026-5934, rated 7.2 by Wordfence, which found it. The National Vulnerability Database points to 3.21.1, released April 7, 2026, as the fix; the advisory itself wasn’t published until August 28.

A stored script runs in the browser of whoever views the page, including a logged-in administrator. That’s what makes this kind of bug worth fixing quickly: on a WordPress site, a script running in an administrator’s session can do anything that administrator can.

Two more were published in October, both fixed in 3.23.5 on October 1. CVE-2026-97075 (CVSS 6.5) is a missing authorization check that lets an anonymous request reach something it shouldn’t. CVE-2026-97076 (CVSS 7.5) lets an anonymous request tie up the server; Patchstack classes it as denial of service, meaning the site can be knocked offline. Neither needs a login.

As of today none of the three is on CISA’s list of actively exploited vulnerabilities, and we haven’t seen a report of attacks. Patchstack notes that unauthenticated cross-site scripting is the kind of flaw used in mass campaigns against thousands of sites at once.

Why so many sites are behind

WP Rocket isn’t on WordPress.org; it’s sold by annual license. WP Rocket’s own help page says that when a license expires, the site loses plugin updates while the plugin itself keeps working normally. Nothing breaks and nothing warns the visitor, so a site can sit on an old version for years without anyone noticing. A site that was built once, by someone who has since moved on, is the usual case.

On October 26 we found a working business site in the Carolinas still on 3.20.2, more than six months after the first fix shipped.

What to do

1. Check your versionIn WordPress, go to Plugins and find WP Rocket. Many sites also print it in the page’s source: view source on your home page and search for “WP Rocket”. Anything below 3.23.5 needs the update.
2. Check the licenseIn Settings, open WP Rocket and look at the license status. If it’s expired, renewing it is what turns updates back on; there’s no other supported way to get the fixed version.
3. Back up, then update to 3.23.5 or newerTake a backup, update, then clear the cache and click through your main pages and forms. The current release is 3.23.5.1.
4. If you can’t update this weekTurning WP Rocket off removes all three flaws at the cost of speed. A web application firewall with WordPress rules is the other stopgap.

If your site was on an old version for a long time and something looks off, like pages that redirect strangely, admin accounts you don’t recognize or a browser warning, don’t just update and move on. Change the passwords and get it checked properly; our incident response team handles exactly that. The sites we build don’t run on plugins like this, so there’s no license to lapse; here’s how our care plans work.

Sources

• CVE-2026-5934 (National Vulnerability Database)
• Wordfence: WP Rocket 3.21.0.1 unauthenticated stored cross-site scripting
• WP Rocket 3.21.1 release (GitHub)
• CVE-2026-97075 (National Vulnerability Database)
• CVE-2026-97076 (National Vulnerability Database)
• WP Rocket 3.23.5 release notes (GitHub)
• Patchstack database: WP Rocket
• WP Rocket: what happens if my license expires