Research Plan: CVE-2026-22492 - Docket Cache Missing Authorization

1. Vulnerability Summary

The Docket Cache – Object Cache Accelerator plugin (up to version 24.07.04) is vulnerable to Missing Authorization. The plugin registers several AJAX handlers intended for administrative use (e.g., clearing the cache, toggling features) but fails to implement proper capability checks (e.g., current_user_can('manage_options')) within these handlers. While the handlers may implement nonce verification, the nonces are often exposed to all authenticated users via the WordPress admin dashboard or admin bar. This allows an authenticated attacker with low-level privileges (Subscriber) to perform actions that should be restricted to administrators.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: docket_cache_action (inferred) or docket_cache_toggle (inferred)
• Payload Parameters:
  • action: docket_cache_action
  • docket_action: The specific operation to perform (e.g., flush_all, gc, opc_flush)
  • nonce: The CSRF token generated for the action.
• Authentication: Subscriber-level access or higher is required.
• Preconditions: The plugin must be active and the attacker must be logged in to access the admin area (even if just profile.php).

3. Code Flow (Inferred)

1. Registration: The plugin registers the AJAX action in the admin context (likely includes/admin.php or includes/class-admin.php).
   • add_action('wp_ajax_docket_cache_action', array($this, 'ajax_action'));
2. Entry Point: When a Subscriber sends a POST request to admin-ajax.php with action=docket_cache_action.
3. Handler Execution: The function ajax_action() is called.
4. Incomplete Security Check:
   • The handler calls check_ajax_referer('docket-cache-action', 'nonce') or wp_verify_nonce(). This check passes because the Subscriber has retrieved a valid nonce.
   • The handler fails to call current_user_can('manage_options').
5. Sink: The function proceeds to execute the requested docket_action, such as calling docket_cache_flush_all(), affecting the site's performance and integrity.

4. Nonce Acquisition Strategy

Docket Cache localizes a configuration object for its JavaScript components. This object typically contains the necessary nonce for AJAX operations and is often enqueued for all users who can see the WordPress Admin Bar.

1. Identify Trigger: The plugin enqueues the docket-cache-adminbar or docket-cache-settings script.
2. Access Admin Area: Log in as a Subscriber and navigate to /wp-admin/profile.php.
3. Extraction:
   • Variable Name: docket_cache_object (inferred) or docket_cache_adminbar (inferred).
   • Nonce Key: nonce.
   • Browser Eval: Use the browser_eval tool to retrieve the token:
     browser_eval("window.docket_cache_object?.nonce || window.docket_cache_adminbar?.nonce")
4. Verification: Confirm the nonce is a 10-character hexadecimal string.

5. Exploitation Strategy

1. Setup Session: Log in as a Subscriber user and capture the session cookies.
2. Extract Nonce: Navigate to /wp-admin/profile.php and use the JS evaluation method described above to find the docket-cache-action nonce.
3. Construct Payload:
   • Method: POST
   • URL: http://[target]/wp-admin/admin-ajax.php
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body: action=docket_cache_action&docket_action=flush_all&nonce=[EXTRACTED_NONCE]
4. Execute Request: Use the http_request tool to send the payload.
5. Analyze Response: A successful exploit should return a JSON response indicating success (e.g., {"success": true, "data": "..."}), whereas a properly secured version would return 403 Forbidden or a JSON error.

6. Test Data Setup

1. Install Docket Cache: Ensure version 24.07.04 or lower is installed.
2. Create User:
   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
3. Generate Cache Data: Navigate the frontend of the site to ensure the object cache is populated.
4. Verify Access: Confirm the Subscriber user cannot access wp-admin/admin.php?page=docket-cache (should receive "You do not have sufficient permissions").

7. Expected Results

• Success: The http_request returns 200 OK with a JSON payload confirming the cache flush or setting change.
• Impact: The site's object cache is cleared, which can be observed through significantly increased page load times for the next few requests or via plugin statistics.

8. Verification Steps

1. Check Cache Status: Use WP-CLI to verify if the cache was cleared.
   wp docket cache stats (if available) or check the size of the cache directory:
   ls -lh /var/www/html/wp-content/docket-cache-data/
2. Check Response Code: Ensure the Subscriber received a "success" response for an administrative action they should not have been able to trigger.

9. Alternative Approaches

• Toggle Cron: Attempt to toggle the Docket Cache cron system:
  action=docket_cache_action&docket_action=toggle_cron&nonce=[NONCE]
• Version Check: Attempt to trigger a version check or update notification:
  action=docket_cache_action&docket_action=vcheck&nonce=[NONCE]
• Frontend Nonce: If the admin bar is visible on the frontend, attempt to extract the nonce from the site's homepage while logged in as a Subscriber.