CVE-2026-22492
Missing Authorization in Nawawi Jamili Docket Cache Allows Unauthorized Access
Publication date: 2026-01-08
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | docket_cache | From 24.07.04|end_including=24.07.04 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-22492 is a Broken Access Control vulnerability in the WordPress Docket Cache Plugin (up to version 24.07.04). It occurs because of missing authorization, authentication, or nonce token checks in certain plugin functions. This flaw allows users with low privileges (such as Subscriber or Developer roles) to perform actions that should be restricted to higher-privileged users. [1]
How can this vulnerability impact me? :
This vulnerability could allow lower-privileged users to execute actions reserved for higher-privileged roles, potentially leading to unauthorized changes or disruptions. However, the impact is considered low severity with a CVSS score of 4.3, and it is unlikely to be widely exploited. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection commands or network indicators provided for this vulnerability. Detection would involve reviewing the WordPress Docket Cache plugin version (up to 24.07.04) and checking for unauthorized access attempts by users with Subscriber or Developer roles performing higher-privileged actions. Since no official fix or detection tools are mentioned, monitoring access logs for unusual privilege escalations may help. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting user roles to prevent unprivileged users (Subscriber or Developer) from performing higher-privileged actions, monitoring for suspicious activity, and applying any available security measures from Patchstack's mitigation services. Since no official patch or fixed version is available yet, careful access control and monitoring are recommended. [1]