CVE-2026-4123

Name of the Vulnerable Software and Affected Versions RW Elephant Rental Inventory versions prior to 2.3.14

Description The plugin contains a missing authorization flaw. The toggle cache() function, which is linked to the wp ajax toggle cache AJAX action, does not perform a capability check or nonce verification. A nonce is a unique token used to protect against cross-site request forgery. This allows authenticated users with Subscriber-level permissions or higher to enable or disable the plugin cache by sending a POST request to the admin-ajax endpoint.

Recommendations Update the plugin to version 2.3.14 or later. As a temporary mitigation, restrict access to the toggle cache() function.