CVE-2026-4123
mediumThe RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13.
The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the toggle_cache() function which is hooked to the wp_ajax_toggle_cache AJAX action. The function also lacks nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to toggle the plugin's cache setting on or off by sending a POST request to admin-ajax.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://plugins.trac.wordpress.org/browser/rw-elephant-rental-inventory/tags/2.3.11/lib/cl... security@wordfence.com
- https://plugins.trac.wordpress.org/browser/rw-elephant-rental-inventory/tags/2.3.11/lib/cl... security@wordfence.com
- https://plugins.trac.wordpress.org/browser/rw-elephant-rental-inventory/trunk/lib/classes/... security@wordfence.com
- https://plugins.trac.wordpress.org/browser/rw-elephant-rental-inventory/trunk/lib/classes/... security@wordfence.com
- https://plugins.trac.wordpress.org/changeset/3551183 security@wordfence.com
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5e46beca-e33b-4ed9-a0ab-612a6987... security@wordfence.com