# Docket Cache <= 26.04.09 - Unauthenticated PHP Object Injection via Object Cache Values

- **ID:** WPSEC-2026-1087
- **Plugin:** Docket Cache – Object Cache Accelerator (`docket-cache`), https://wordpress.org/plugins/docket-cache/
- **Affected versions:** all versions before 26.04.10
- **Fixed in:** 26.04.10 (Update to 26.04.10 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-502
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/docket-cache
- **Fix released:** 2026-10-13
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1087/

## Description

The Docket Cache plugin for WordPress is vulnerable to PHP Object Injection via cached string values in all versions up to, and including, 26.04.09, due to deserialization of untrusted input in the object cache drop-in. When a cached string was already in serialized form and referenced a class other than stdClass, dc_save() kept it as-is and marked it 'string_serialize'. dc_get() then passed every such value to unserialize() with no class restriction. Values that WordPress later unserializes again, such as non-autoloaded option values, were therefore deserialized twice. This makes it possible for unauthenticated attackers to inject a PHP object wherever another component stores attacker-supplied text in a cached string, for example in an option or transient. No known POP chain is present in the plugin itself. If a POP chain is present through another plugin or theme, the attacker may be able to delete arbitrary files, retrieve sensitive data, or execute code.

## References

- https://wpsec.com/vuln/WPSEC-2026-1087/
- https://plugins.svn.wordpress.org/docket-cache/tags/26.04.10/
- https://wordpress.org/plugins/docket-cache/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1087/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.