CVE-2026-22492: 
WordPress vulnerability analysis and mitigation

CVE-2026-22492 is a Missing Authorization vulnerability in the Nawawi Jamili Docket Cache WordPress plugin that allows authenticated low-privileged attackers to exploit incorrectly configured access control security levels, resulting in a denial of service condition. It affects all versions of the Docket Cache plugin through 24.07.04. The vulnerability was published on January 8, 2026, and assigned by Patchstack. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack, Feedly).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify that an authenticated user has the appropriate permissions before allowing access to certain functionality. The attack vector is network-based, requires low privileges (any authenticated WordPress user), and no user interaction. An attacker can exploit misconfigured access control checks within the plugin to trigger actions that impact availability, consistent with the CAPEC-665 pattern of exploiting incorrectly configured security levels (Feedly, Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to disrupt the availability of the affected WordPress site by abusing cache management functions without proper authorization. There is no confidentiality or integrity impact; the vulnerability is limited to an availability (denial of service) impact on the affected WordPress installation. The scope is unchanged, meaning the impact is confined to the vulnerable component itself (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-22492. The EPSS score is approximately 0.036%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users should update the Docket Cache WordPress plugin to a version beyond 24.07.04 as soon as a patched release becomes available from the plugin author, Nawawi Jamili. In the interim, site administrators can mitigate risk by restricting access to the WordPress admin area to trusted IP addresses and ensuring that only necessary user accounts have authenticated access to the site. Monitoring plugin activity logs for unexpected cache-related actions by low-privileged users is also advisable (Patchstack).