CVE-2026-4123
Received Received - Intake

Missing Authorization in RW Elephant Rental Inventory WordPress Plugin

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: Wordfence

Description
The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the toggle_cache() function which is hooked to the wp_ajax_toggle_cache AJAX action. The function also lacks nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to toggle the plugin's cache setting on or off by sending a POST request to admin-ajax.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-4123
EUVD
EUVD-2026-84300

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rw_elephant rental_inventory to 2.3.13 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The RW Elephant Rental Inventory WordPress plugin has a vulnerability due to missing authorization checks. The toggle_cache() function, connected to the wp_ajax_toggle_cache AJAX action, lacks proper capability checks and nonce verification. This allows authenticated users with Subscriber-level access or higher to toggle the plugin's cache setting via a POST request to admin-ajax.

Detection Guidance

Check WordPress sites using the RW Elephant Rental Inventory plugin for unauthorized cache toggles via admin-ajax.php requests. Monitor POST requests to wp_ajax_toggle_cache with Subscriber-level credentials.

Impact Analysis

An attacker could exploit this to turn the plugin's cache on or off without proper authorization. This might disrupt website performance or functionality, potentially leading to slower page loads or inconsistent data display for users.

Compliance Impact

This vulnerability allows authenticated attackers with Subscriber-level access to modify plugin settings, which could potentially lead to unauthorized changes in data handling or storage practices. This may impact compliance with standards like GDPR or HIPAA if such changes affect data protection measures or audit trails.

Mitigation Strategies

Update the RW Elephant Rental Inventory plugin to the latest version beyond 2.3.13. Remove Subscriber-level access where unnecessary and implement strict capability checks for AJAX actions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4123. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart