The Docket Cache plugin for WordPress has a missing authorization flaw that allows attackers to bypass correctly configured access control settings. By exploiting this weakness, an attacker can gain unauthorized access to restricted features or data within the plugin, potentially compromising the confidentiality or integrity of the website’s content and configuration. The vulnerability is caused by an absent or insufficient authorization check (CWE-862).

The issue affects the Nawawi Jamili Docket Cache WordPress plugin for all versions up through and including 24.07.04. Any site running a version in that range is impacted.

The EPSS score is reported to be less than 1%, indicating a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw permits direct unauthorized access to plugin functionality, the potential impact is significant if an attacker successfully leverages the weakness. The attack vector is likely a web-based request to the plugin’s administrative endpoints, and no special conditions beyond typical web access appear to be required. The lack of current exploitation reports suggests limited active exploitation, but the high risk associated with broken access control warrants timely remediation.