{
 "id": "WPSEC-2026-0730",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0730/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0730/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0730/index.md",
 "title": "Docket Cache <= 26.04.07 - Unauthenticated Sensitive Information Exposure via Predictable Cache Log File",
 "description": "The Docket Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 26.04.07. The cache log was written to a predictable file name (.object-cache.log) in the content directory, and it recorded full request URIs, including query string values such as tokens and other secrets. This makes it possible for unauthenticated attackers to download the log file and read sensitive data from other users' requests when the cache log feature is enabled and the file can be reached over the web.",
 "plugin": {
  "slug": "docket-cache",
  "name": "Docket Cache",
  "full_name": "Docket Cache – Object Cache Accelerator",
  "wordpress_org": "https://wordpress.org/plugins/docket-cache/",
  "advisories_url": "https://wpsec.com/vuln/plugin/docket-cache/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/docket-cache"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-532"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "26.04.08",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 26.04.08"
  ]
 },
 "introduced_in": null,
 "fixed_in": "26.04.08",
 "remediation": "Update to 26.04.08 or later.",
 "fix_released": "2026-10-08T16:18:29+00:00",
 "published": "2026-10-10T15:41:27+00:00",
 "updated": "2026-10-10T14:53:44.535782+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0730/",
  "https://plugins.svn.wordpress.org/docket-cache/tags/26.04.08/",
  "https://wordpress.org/plugins/docket-cache/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/docket-cache",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-10"
 }
}