We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

WordPress Security Bulletin: RockPress Plugin Vulnerability (CVE-2026-3550)

Nick Paliughi
On this page

Security Alert Summary

The RockPress plugin for WordPress has a missing authorization vulnerability in all versions up to and including 1.0.17. Multiple AJAX actions lack proper capability checks while the plugin exposes a nonce to all authenticated users via an admin script enqueued on every admin page. As a result, authenticated users can extract the nonce from admin pages and invoke actions that should be restricted.

CVE Details

  • CVE ID: CVE-2026-3550
  • Affected component: RockPress plugin for WordPress
  • Affected versions: All versions up to and including 1.0.17
  • Published: March 20, 2026 9:16 AM UTC
  • Last modified: March 20, 2026 1:37 PM UTC
  • CVSS v3.1: Base score 5.3 (MEDIUM) — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  • Authentication / privileges / interaction (from CVSS): Authentication required: None; Privileges required: None; User interaction: None
  • Primary impact: Confidentiality: None; Integrity: Low; Availability: None
  • CWE: CWE-862 (Missing Authorization)

Technical Details

This vulnerability is caused by missing authorization checks on multiple AJAX actions combined with an exposed nonce. The plugin unconditionally enqueues the rockpress-admin script on all admin pages (including profile.php) and passes a nonce for the rockpress-nonce action to that script via wp_localize_script. The AJAX handlers for the actions rockpress_import, rockpress_import_status, rockpress_last_import, rockpress_reset_import, and rockpress_check_services only verify the nonce and do not perform capability checks such as current_user_can().

Because the nonce is present in the HTML of admin pages and the handlers lack capability checks, any authenticated user who can view an admin page can extract the nonce and call those AJAX endpoints. The named actions allow attackers to trigger import operations, reset import tracking data (deleting options), retrieve import status information, and perform service connectivity checks. The impact is limited to the operations those AJAX handlers perform; the weakness is an authorization bypass rather than a direct disclosure of unrelated sensitive data.

How This Could Impact Your Website

Consider a WordPress site with an administrator (site owner), several editors or staff members, and an external contractor or contributor with Subscriber-level access. A Subscriber or low-privilege authenticated user who can access any admin page could extract the exposed nonce and invoke the RockPress AJAX actions. Practical consequences include:

  • Triggering resource-intensive import operations that could degrade site performance or consume server resources.
  • Resetting import tracking data or deleting options used by the plugin, which may disrupt import workflows and require manual recovery.
  • Running service connectivity checks and reading import status information that should be limited to administrators.

While the CVSS data indicates no direct confidentiality impact for general site data, these actions can still disrupt operations and could provide an attacker with contextual information useful for social engineering. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available.
  • Review and reduce unnecessary user roles, especially contributor and subscriber accounts with admin-area access.
  • Enforce strong passwords and two-factor authentication for editors and administrators.
  • Remove unused or unmaintained plugins from your site.
  • Monitor site activity and server resource usage for unusual behavior or spikes that could indicate abuse of import operations.

If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
WordPress Security Bulletin: CM Custom Reports – Flexible reporting to track what matters most plugin for WordPress (CVE-2026-2432)
Next Post
WordPress Security Bulletin: Kali Forms Plugin Vulnerability (CVE-2026-3584)