Docket Cache <= 26.04.09 - Unauthenticated PHP Object Injection via Object Cache Values
- ID
- WPSEC-2026-1087
- Plugin
- Docket Cache – Object Cache Accelerator (docket-cache)
- Affected
- all versions before 26.04.10
- Remediation
- Update to 26.04.10 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-502
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-16
- Attack surface
- Docket Cache on WPSec AttackSurface
- Fix released
- Published
Description
The Docket Cache plugin for WordPress is vulnerable to PHP Object Injection via cached string values in all versions up to, and including, 26.04.09, due to deserialization of untrusted input in the object cache drop-in. When a cached string was already in serialized form and referenced a class other than stdClass, dc_save() kept it as-is and marked it 'string_serialize'. dc_get() then passed every such value to unserialize() with no class restriction. Values that WordPress later unserializes again, such as non-autoloaded option values, were therefore deserialized twice. This makes it possible for unauthenticated attackers to inject a PHP object wherever another component stores attacker-supplied text in a cached string, for example in an option or transient. No known POP chain is present in the plugin itself. If a POP chain is present through another plugin or theme, the attacker may be able to delete arbitrary files, retrieve sensitive data, or execute code.
References
- https://wpsec.com/vuln/WPSEC-2026-1087/
- https://plugins.svn.wordpress.org/docket-cache/tags/26.04.10/
- https://wordpress.org/plugins/docket-cache/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS