CVE-2026-97076

Summary

A regular expression error in WP Rocket's media handling allows attackers to inject malicious code through crafted input, potentially leading to arbitrary code execution on the WordPress site. This vulnerability is particularly concerning because it can be exploited without authentication and affects the core media processing functionality.

Exploitability

Exploitation appears moderately difficult as it requires crafting a specific regular expression pattern that triggers the error condition, but the vulnerability is remotely exploitable with no authentication required.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on the WordPress server, potentially leading to full site compromise, data exfiltration, or use as a pivot point for attacking other systems in the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to WP Rocket version 3.23.5 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.