CVE-2026-3550: 
WordPress vulnerability analysis and mitigation

CVE-2026-3550 is a Missing Authorization vulnerability in the RockPress plugin for WordPress, affecting all versions up to and including 1.0.17. The flaw allows authenticated attackers with Subscriber-level access or above to perform administrative actions — including triggering imports, resetting import data, and checking service connectivity — that should be restricted to administrators. It was published on March 20, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, CIRCL).

The root cause is CWE-862 (Missing Authorization): the plugin's AJAX action handlers (rockpress_import, rockpress_import_status, rockpress_last_import, rockpress_reset_import, and rockpress_check_services) verify only a nonce but never call current_user_can() to enforce capability checks. Compounding the issue, the rockpress-admin script — which passes the rockpress-nonce value via wp_localize_script — is unconditionally enqueued on all WordPress admin pages (including profile.php) regardless of the user's role or the page being viewed. Any authenticated user can therefore load an admin page, extract the nonce from the HTML source, and submit crafted AJAX requests to trigger privileged operations (Feedly, InfinitSec).

Successful exploitation allows low-privileged authenticated users (Subscriber and above) to trigger resource-intensive import operations that may degrade site performance, delete or reset import tracking data stored as WordPress options, and probe external service connectivity — actions normally reserved for administrators. While confidentiality impact is assessed as none and the primary concern is integrity and availability disruption, the ability to reset import data could result in data loss or corruption of plugin-managed content (Feedly, CIRCL).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-3550 as of the latest available data. The EPSS score is approximately 0.04%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid authenticated session (at minimum Subscriber level), limiting the attack surface compared to unauthenticated vulnerabilities (Feedly).

1. Obtain Authenticated Access: Register or log in to the target WordPress site with any authenticated account, including a Subscriber-level account.
2. Navigate to an Admin Page: Access any WordPress admin page that loads the rockpress-admin script (e.g., wp-admin/profile.php), which is enqueued unconditionally for all authenticated users.
3. Extract the Nonce: View the page source or use browser developer tools to locate the rockpress-nonce value passed via wp_localize_script in the page's JavaScript.
4. Craft AJAX Request: Send a POST request to wp-admin/admin-ajax.php with the extracted nonce and the desired action parameter (e.g., action=rockpress_import, action=rockpress_reset_import, action=rockpress_check_services, etc.).
5. Trigger Privileged Operation: The server validates only the nonce (not user capabilities), so the action executes — allowing the attacker to initiate imports, delete import tracking options, or probe external service connections (InfinitSec, Feedly).

• Logs: WordPress access logs showing repeated POST requests to wp-admin/admin-ajax.php with action=rockpress_import, action=rockpress_reset_import, action=rockpress_last_import, action=rockpress_check_services, or action=rockpress_import_status from low-privileged user sessions.
• Logs: WordPress debug logs or error logs showing unexpected import operations or option deletions initiated outside of normal administrative activity.
• Network: Unusual outbound connections from the WordPress server to external services triggered by rockpress_check_services AJAX calls from non-administrator accounts.
• Application: WordPress options table showing unexpected resets or deletions of RockPress import tracking data at unusual times or frequencies.

WordPress site administrators should update the RockPress plugin to a version beyond 1.0.17 that includes proper capability checks (current_user_can()) on all AJAX handlers and restricts nonce exposure to authorized users only. Until a patched version is available, administrators can mitigate risk by disabling the RockPress plugin entirely or restricting site registration to prevent untrusted users from obtaining Subscriber-level accounts. Monitoring AJAX logs for unauthorized action calls (as described in the IOCs section) is also recommended as a detective control (Feedly, InfinitSec).