Vulnerabilities / Docket Cache / WPSEC-2026-0730
Docket Cache <= 26.04.07 - Unauthenticated Sensitive Information Exposure via Predictable Cache Log File
Medium 5.9
CWE-532Fixed in 26.04.08
- ID
- WPSEC-2026-0730
- Plugin
- Docket Cache – Object Cache Accelerator (docket-cache)
- Affected
- all versions before 26.04.08
- Remediation
- Update to 26.04.08 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-532
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-10
- Attack surface
- Docket Cache on WPSec AttackSurface
- Fix released
- Published
Description
The Docket Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 26.04.07. The cache log was written to a predictable file name (.object-cache.log) in the content directory, and it recorded full request URIs, including query string values such as tokens and other secrets. This makes it possible for unauthenticated attackers to download the log file and read sensitive data from other users' requests when the cache log feature is enabled and the file can be reached over the web.
References
- https://wpsec.com/vuln/WPSEC-2026-0730/
- https://plugins.svn.wordpress.org/docket-cache/tags/26.04.08/
- https://wordpress.org/plugins/docket-cache/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS