The RockPress plugin for WordPress contains a missing authorization flaw in all versions up to and including 1.0.17. Several AJAX handlers (rockpress_import, rockpress_import_status, rockpress_last_import, rockpress_reset_import, rockpress_check_services) perform only nonce verification and do not check user capabilities. The plugin permanently enqueues the 'rockpress-admin' script on every admin page, exposing the nonce to any authenticated user. As a result, an attacker who can log in as a Subscriber or higher can extract the nonce from the HTML source and use it to trigger import operations, delete tracking options, force service checks, and read import status. This allows arbitrary modification of the plugin’s data and potentially exhaustion of resources, compromising data integrity and availability. The weakness is classified as CWE-862, Missing Authorization.

This vulnerability affects the Firetree RockPress plugin for WordPress versions 1.0.17 and earlier. All installations that include these versions are susceptible, regardless of additional configuration. The plugin’s administrative script is enqueued on every admin page, including profile.php, meaning the risk is present for all sites running the vulnerable plugin version.

The CVSS score is 5.3, indicating moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be an authenticated attacker using a standard user session; the vulnerability does not require remote code execution or network exploitation. The attacker needs a valid login with at least Subscriber privileges, which are commonly granted in many WordPress installations. Once authenticated, extraction of the nonce from any admin page allows the attacker to perform the privileged operations through simple HTTP POST requests to the AJAX handlers.