CVE-2026-3550

{"id": "CVE-2026-3550", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2026-03-20T09:16:16.390", "references": [{"url": "https://plugins.trac.wordpress.org/browser/ft-rockpress/tags/1.0.17/includes/admin/admin-ajax.php#L33", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/ft-rockpress/tags/1.0.17/includes/admin/admin-scripts.php#L50", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/ft-rockpress/tags/1.0.17/includes/admin/admin-scripts.php#L88", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/ft-rockpress/tags/1.0.17/includes/class-rockpress-import.php#L125", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/ft-rockpress/tags/1.0.17/includes/class-rockpress-import.php#L145", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/ft-rockpress/tags/1.0.17/includes/class-rockpress-import.php#L184", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/ft-rockpress/tags/1.0.17/includes/class-rockpress-import.php#L206", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/ft-rockpress/trunk/includes/admin/admin-ajax.php#L33", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/ft-rockpress/trunk/includes/admin/admin-scripts.php#L50", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/ft-rockpress/trunk/includes/admin/admin-scripts.php#L88", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/ft-rockpress/trunk/includes/class-rockpress-import.php#L125", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/ft-rockpress/trunk/includes/class-rockpress-import.php#L145", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/ft-rockpress/trunk/includes/class-rockpress-import.php#L184", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/ft-rockpress/trunk/includes/class-rockpress-import.php#L206", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3477205%40ft-rockpress&new=3477205%40ft-rockpress&sfp_email=&sfph_mail=", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d5031631-9f12-47d3-997d-4418d348ab40?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The RockPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.17. This is due to missing capability checks on multiple AJAX actions (rockpress_import, rockpress_import_status, rockpress_last_import, rockpress_reset_import, and rockpress_check_services) combined with the plugin's nonce being exposed to all authenticated users via an unconditionally enqueued admin script. The plugin enqueues the 'rockpress-admin' script on all admin pages (including profile.php) without any page or capability restrictions, and the nonce for the 'rockpress-nonce' action is passed to this script via wp_localize_script. Since the AJAX handlers only verify this nonce and do not check current_user_can(), any authenticated user, including Subscribers, can extract the nonce from any admin page's HTML source and use it to trigger imports, reset import data (deleting options), check service connectivity, and read import status information. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger resource-intensive import operations, reset import tracking data, and perform system connection checks that should be restricted to administrators."}, {"lang": "es", "value": "El plugin RockPress para WordPress es vulnerable a Autorizaci\u00f3n Faltante en todas las versiones hasta la 1.0.17, inclusive. Esto se debe a la falta de comprobaciones de capacidad en m\u00faltiples acciones AJAX (rockpress_import, rockpress_import_status, rockpress_last_import, rockpress_reset_import y rockpress_check_services) combinado con la exposici\u00f3n del nonce del plugin a todos los usuarios autenticados a trav\u00e9s de un script de administraci\u00f3n encolado incondicionalmente. El plugin encola el script 'rockpress-admin' en todas las p\u00e1ginas de administraci\u00f3n (incluyendo profile.php) sin ninguna restricci\u00f3n de p\u00e1gina o capacidad, y el nonce para la acci\u00f3n 'rockpress-nonce' se pasa a este script a trav\u00e9s de wp_localize_script. Dado que los manejadores AJAX solo verifican este nonce y no comprueban current_user_can(), cualquier usuario autenticado, incluyendo los Suscriptores, puede extraer el nonce del c\u00f3digo fuente HTML de cualquier p\u00e1gina de administraci\u00f3n y usarlo para activar importaciones, restablecer datos de importaci\u00f3n (eliminando opciones), verificar la conectividad del servicio y leer informaci\u00f3n del estado de la importaci\u00f3n. Esto hace posible que atacantes autenticados, con acceso de nivel de Suscriptor y superior, activen operaciones de importaci\u00f3n que consumen muchos recursos, restablezcan datos de seguimiento de importaci\u00f3n y realicen comprobaciones de conexi\u00f3n del sistema que deber\u00edan estar restringidas a los administradores."}], "lastModified": "2026-04-22T21:32:08.360", "sourceIdentifier": "security@wordfence.com"}