Executive Summary

CVE-2026-22492 is a Broken Access Control vulnerability in the WordPress Docket Cache Plugin (up to version 24.07.04). It occurs because of missing authorization, authentication, or nonce token checks in certain plugin functions. This flaw allows users with low privileges (such as Subscriber or Developer roles) to perform actions that should be restricted to higher-privileged users. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow lower-privileged users to execute actions reserved for higher-privileged roles, potentially leading to unauthorized changes or disruptions. However, the impact is considered low severity with a CVSS score of 4.3, and it is unlikely to be widely exploited. [1]

Useful 0 Not Useful 0

Detection Guidance

There are no specific detection commands or network indicators provided for this vulnerability. Detection would involve reviewing the WordPress Docket Cache plugin version (up to 24.07.04) and checking for unauthorized access attempts by users with Subscriber or Developer roles performing higher-privileged actions. Since no official fix or detection tools are mentioned, monitoring access logs for unusual privilege escalations may help. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting user roles to prevent unprivileged users (Subscriber or Developer) from performing higher-privileged actions, monitoring for suspicious activity, and applying any available security measures from Patchstack's mitigation services. Since no official patch or fixed version is available yet, careful access control and monitoring are recommended. [1]

Useful 0 Not Useful 0