{
 "id": "WPSEC-2026-1086",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1086/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1086/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1086/index.md",
 "title": "Docket Cache <= 26.04.09 - Unauthenticated Sensitive Information Exposure of WP-CLI OPcache Shared Secret",
 "description": "The Docket Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 26.04.03 up to, and including, 26.04.09, due to the WP-CLI OPcache shared secret being stored in a plain-text file under the web-accessible docket-cache-data/lock directory. The file has a predictable name, and the secret is created on any REST API request. This makes it possible for unauthenticated attackers to read the secret and send validly signed requests to the plugin's OPcache invalidation REST endpoint, for example to repeatedly reset the server's OPcache.",
 "plugin": {
  "slug": "docket-cache",
  "name": "Docket Cache",
  "full_name": "Docket Cache – Object Cache Accelerator",
  "wordpress_org": "https://wordpress.org/plugins/docket-cache/",
  "advisories_url": "https://wpsec.com/vuln/plugin/docket-cache/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/docket-cache"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-552"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "26.04.03",
    "from_inclusive": true,
    "to": "26.04.10",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 26.04.03 before 26.04.10"
  ]
 },
 "introduced_in": "26.04.03",
 "fixed_in": "26.04.10",
 "remediation": "Update to 26.04.10 or later.",
 "fix_released": "2026-10-13T19:19:34+00:00",
 "published": "2026-10-16T11:46:25+00:00",
 "updated": "2026-10-16T10:56:24.798390+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1086/",
  "https://plugins.svn.wordpress.org/docket-cache/tags/26.04.10/",
  "https://wordpress.org/plugins/docket-cache/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/docket-cache",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-16"
 }
}