CVE-2026-22492: Docket Cache Auth Bypass Vulnerability

CVE-2026-22492 Overview

A Missing Authorization vulnerability has been identified in the Docket Cache plugin for WordPress, developed by Nawawi Jamili. This broken access control flaw allows attackers to exploit incorrectly configured access control security levels, potentially enabling unauthorized actions within WordPress installations running vulnerable versions of the plugin.

Critical Impact

Authenticated attackers with low privileges can bypass intended access restrictions in the Docket Cache plugin, potentially leading to denial of service conditions affecting cached content and site performance.

Affected Products

• Docket Cache WordPress plugin versions up to and including 24.07.04
• WordPress installations with Docket Cache plugin enabled
• Sites using Docket Cache for object caching functionality

Discovery Timeline

• January 8, 2026 - CVE-2026-22492 published to NVD
• January 8, 2026 - Last updated in NVD database

Technical Details for CVE-2026-22492

Vulnerability Analysis

This vulnerability falls under CWE-862 (Missing Authorization), indicating that the Docket Cache plugin fails to properly verify user permissions before allowing certain actions. The flaw exists due to inadequate access control checks on sensitive plugin functionality.

The vulnerability is exploitable over the network and requires low privileges to execute. While no user interaction is required, the attack scope is unchanged, meaning the vulnerable component itself is the affected resource. The primary impact is on availability, as exploitation could disrupt the caching functionality that the plugin provides.

Root Cause

The root cause stems from missing authorization checks within the Docket Cache plugin's code paths. When handling certain requests, the plugin does not properly validate whether the authenticated user has sufficient privileges to perform the requested action. This allows users with minimal authentication (such as subscribers or contributors) to access functionality intended only for administrators.

Attack Vector

An authenticated attacker with low-level credentials on a WordPress site can send crafted requests to the Docket Cache plugin's endpoints. Because the plugin fails to verify proper authorization levels, these requests are processed regardless of the user's actual role. This can result in unauthorized manipulation of cache settings or cache invalidation, leading to availability impacts on the affected WordPress site.

The attack scenario involves:

1. An attacker obtains low-privilege authentication on a WordPress site (e.g., subscriber role)
2. The attacker identifies Docket Cache plugin endpoints lacking proper authorization checks
3. Unauthorized requests are sent to manipulate cache functionality
4. Site performance degrades due to cache manipulation or unexpected cache behavior

Detection Methods for CVE-2026-22492

Indicators of Compromise

• Unexpected cache flushes or invalidations in WordPress error logs
• Unusual API requests to Docket Cache endpoints from low-privilege user accounts
• Multiple failed or successful attempts to access admin-only cache functions by non-administrator users
• Abnormal plugin activity patterns in WordPress audit logs

Detection Strategies

• Monitor WordPress activity logs for Docket Cache-related actions by users who should not have cache management permissions
• Implement web application firewall rules to detect unusual request patterns targeting the Docket Cache plugin
• Review access logs for repeated requests to plugin endpoints from authenticated sessions with minimal privileges
• Deploy endpoint detection solutions that can identify broken access control exploitation attempts

Monitoring Recommendations

• Enable comprehensive logging for WordPress plugin activities, particularly for cache-related operations
• Configure alerts for cache management actions performed by non-administrator users
• Regularly audit user roles and permissions on WordPress installations
• Implement real-time monitoring for availability impacts that may indicate cache manipulation

How to Mitigate CVE-2026-22492

Immediate Actions Required

• Update the Docket Cache plugin to the latest version that includes authorization fixes
• Review WordPress user accounts and remove unnecessary low-privilege users who may be used for exploitation
• Temporarily restrict access to the WordPress admin area from untrusted networks
• Audit recent plugin activity logs for signs of unauthorized access attempts

Patch Information

Organizations should update the Docket Cache plugin to a version newer than 24.07.04 that addresses this missing authorization vulnerability. Refer to the Patchstack Vulnerability Advisory for detailed patch information and remediation guidance.

Workarounds

• If updating is not immediately possible, consider temporarily disabling the Docket Cache plugin until a patched version can be applied
• Implement additional access control at the web server level (e.g., via .htaccess or nginx configuration) to restrict plugin endpoint access
• Use a Web Application Firewall (WAF) to block suspicious requests targeting the vulnerable plugin
• Limit WordPress user registrations and remove accounts that are not actively needed

# Example: Restrict plugin access via .htaccess (Apache)
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-content/plugins/docket-cache/ [NC]
    RewriteCond %{REMOTE_ADDR} !^192\.168\.1\. [NC]
    RewriteRule .* - [F,L]
</IfModule>