# Docket Cache <= 26.04.09 - Unauthenticated Sensitive Information Exposure of WP-CLI OPcache Shared Secret

- **ID:** WPSEC-2026-1086
- **Plugin:** Docket Cache – Object Cache Accelerator (`docket-cache`), https://wordpress.org/plugins/docket-cache/
- **Affected versions:** from 26.04.03 before 26.04.10
- **Fixed in:** 26.04.10 (Update to 26.04.10 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
- **Weakness:** CWE-552
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/docket-cache
- **Fix released:** 2026-10-13
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1086/

## Description

The Docket Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 26.04.03 up to, and including, 26.04.09, due to the WP-CLI OPcache shared secret being stored in a plain-text file under the web-accessible docket-cache-data/lock directory. The file has a predictable name, and the secret is created on any REST API request. This makes it possible for unauthenticated attackers to read the secret and send validly signed requests to the plugin's OPcache invalidation REST endpoint, for example to repeatedly reset the server's OPcache.

## References

- https://wpsec.com/vuln/WPSEC-2026-1086/
- https://plugins.svn.wordpress.org/docket-cache/tags/26.04.10/
- https://wordpress.org/plugins/docket-cache/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1086/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.