CVE-2026-4123CWE-862broken-access-control

CVE-2026-4123

Medium · published September 22, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
27.9
In the wild
Unconfirmed
What it is

The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the toggle_cache() function which is hooked to the wp_ajax_toggle_cache AJAX action. The function also lacks nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to toggle the plugin's cache setting on or off by sending a POST request to admin-ajax.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00354 · 27.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-22T12:16Z
References (6)
https://plugins.trac.wordpress.org/browser/rw-elephant-rental-inventory/tags/2.3.11/lib/classes/class-options.php#L1524 · [email protected]https://plugins.trac.wordpress.org/browser/rw-elephant-rental-inventory/tags/2.3.11/lib/classes/class-options.php#L75 · [email protected]https://plugins.trac.wordpress.org/browser/rw-elephant-rental-inventory/trunk/lib/classes/class-options.php#L1524 · [email protected]https://plugins.trac.wordpress.org/browser/rw-elephant-rental-inventory/trunk/lib/classes/class-options.php#L75 · [email protected]https://plugins.trac.wordpress.org/changeset/3551183 · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/5e46beca-e33b-4ed9-a0ab-612a6987174e?source=cve · [email protected]
EPSS history
Timeline
  • 23 SEP 03:46Z
    EPSS moved — → 0%
    epss
  • 22 SEP 07:41Z
    RW Elephant Rental Inventory <= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action
    cvelistv5