The bug lived in WP Rocket’s Cloudflare compatibility file, inc/ThirdParty/Plugins/CDN/Cloudflare.php, around line 562.
The plugin’s substr() call received an integer where it expected a string. WordPress 7.1 changed how $wp_filter handles certain hook callback keys, and that change tripped the error.
Not every WP Rocket site broke. Sites on PHP 8.x with specific configurations were the ones that hit critical error screens or went down entirely.
On August 20, WP Rocket (built by WP Media) posted a warning to users:
The company shipped version 3.23.2.2 the same day with a targeted fix.
WordPress sites already broken were told to update the plugin or, if they’d lost admin access, follow the documented recovery steps. Sites that hadn’t upgraded yet were told to update WP Rocket first, then WordPress.
WordPress Response
The official WordPress account wasn’t happy about the advisory. On August 22, it quoted WP Rocket’s post and pushed back hard. WordPress official told users not to update wasn’t the answer, since the bug wasn’t a WordPress 7.1 problem.
The account suggested users reconsider using WP Rocket at all, and pointed out this is one of the risks of running plugins from outside the official directory. It named several directory-listed alternatives that had no similar issues on release day.
Follow-up posts from the WordPress account raised the timeline.
Someone had filed the bug on WP Rocket’s public GitHub repo on July 6, 2026, 44 days before the 7.1 release, complete with reproduction steps and a one-line fix suggestion.
That’s during the early beta cycle, when WordPress runs its structured beta and release-candidate process specifically so plugin authors can catch this kind of thing.
WordPress also flagged unusual GitHub activity on the WP Rocket repository tied to an account using WordPress branding.
Public Fallout on WP Rocket vs WordPress
Hosting providers and community members tracked the fallout. Anchor Hosting patched affected customer sites by hand while waiting on the plugin fix.
Jetpack and several independent WordPress outlets covered the episode as a case study in performance plugins falling behind core updates. They noted that WP Rocket had pushed other releases in the weeks before 7.1 without touching this issue.
People are also criticizing the public reaction of WordPress official on this fiasco:
What is WP Rocket
WP Rocket is a paid, commercial plugin sold outside the free WordPress.org directory. WordPress’s criticism drew a direct line between that distribution model and the lack of pre-release testing, contrasting it with directory plugins that came through 7.1 clean.
The exchange has opened up a broader conversation in the WordPress community:
- what should commercial plugin vendors owe users in terms of beta testing,
- how sharp should official accounts get in public call-outs, and
- how does core keep shipping fast without breaking the plugins people depend on.
What To Do Now
WP Rocket 3.23.2.2 and later fixes the issue. Back up your site before any core update. Test WordPress upgrades on staging when you can. And when a plugin puts out a compatibility warning, update the plugin before you touch WordPress core.
