Vulnerability · Published Sep 22, 2026 · Assigned by Wordfence
CVE-2026-4123RW Elephant Rental Inventory <= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action
Medium 4.3
In plain English
A medium-severity missing authorization in RW Elephant Rental Inventory from rwelephant01. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Official description
The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the toggle_cache() function which is hooked to the wp_ajax_toggle_cache AJAX action. The function also lacks nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to toggle the plugin's cache setting on or off by sending a POST request to admin-ajax.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| rwelephant01 | RW Elephant Rental Inventory | 0 – through 2.3.13 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5e46beca-e33b-4ed9-a0ab-612a6987174e?source=cve
- https://plugins.trac.wordpress.org/browser/rw-elephant-rental-inventory/trunk/lib/classes/class-options.php#L1524
- https://plugins.trac.wordpress.org/browser/rw-elephant-rental-inventory/tags/2.3.11/lib/classes/class-options.php#L1524
- https://plugins.trac.wordpress.org/browser/rw-elephant-rental-inventory/trunk/lib/classes/class-options.php#L75
- https://plugins.trac.wordpress.org/browser/rw-elephant-rental-inventory/tags/2.3.11/lib/classes/class-options.php#L75
- https://plugins.trac.wordpress.org/changeset/3551183