Description

The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the toggle_cache() function which is hooked to the wp_ajax_toggle_cache AJAX action. The function also lacks nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to toggle the plugin's cache setting on or off by sending a POST request to admin-ajax.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-22T08:16:39.370Z",
  "pubdate": "2026-09-22T08:16:39.370Z",
  "executiveSummary": "The RW Elephant Rental Inventory plugin for WordPress contains a critical authorization flaw due to improper access control in the toggle_cache() function.\nThis vulnerability is classified as Missing Authorization, allowing authenticated users with Subscriber-level privileges or higher to manipulate the plugin's internal cache state.\nThe flaw stems from the omission of necessary capability checks and cryptographic nonce verification within the wp_ajax_toggle_cache AJAX action handler.\nBecause the function fails to validate the requester's permissions or the legitimacy of the request, an attacker can force the plugin to toggle its caching mechanism regardless of intended administrative policy.\nThe risk implication is primarily related to unauthorized administrative configuration changes, which could be leveraged to degrade performance, disrupt service availability, or potentially facilitate further exploitation by manipulating the plugin's data handling behavior.\nExploitation requires minimal effort, as an attacker only needs a valid WordPress user account with Subscriber access and the ability to send a crafted POST request to the administrative AJAX endpoint.",
  "technicalDetails": "The root cause of the vulnerability lies in the implementation of the toggle_cache() function within the RW Elephant Rental Inventory plugin. This function is explicitly registered as a handler for the 'wp_ajax_toggle_cache' action in the WordPress environment.\nUpon inspection of the vulnerable code path, it is evident that the function fails to perform two fundamental security checks required for administrative AJAX actions in WordPress: capability verification via current_user_can() and nonce validation via check_ajax_referer().\nIn the WordPress ecosystem, AJAX actions that modify administrative settings must enforce strict authorization logic. By omitting these checks, the plugin exposes a sensitive configuration toggle to any authenticated user, effectively bypassing the principle of least privilege.\nThe attack flow begins when an attacker, authenticated as a Subscriber, constructs a POST request directed at the '/wp-admin/admin-ajax.php' endpoint. The request must include the 'action' parameter set to 'wp_ajax_toggle_cache'.\nBecause the application logic does not verify the user's role or the authenticity of the request origin, the server-side process executes the toggle_cache() function immediately upon receipt of the request. The function subsequently alters the internal plugin state, enabling or disabling the cache as intended by the attacker.\nThe vulnerability affects all versions of the RW Elephant Rental Inventory plugin up to and including version 2.3.13. Since this is a server-side logic flaw, the exploitation surface is reachable via any network interface that allows access to the WordPress administrative backend.\nPost-exploitation impact includes unauthorized modification of plugin settings. While the immediate result is the toggling of the cache, the ability to modify plugin behavior without administrative authorization constitutes a significant breach of access control, which could be chained with other vulnerabilities or utilized to perform denial-of-service (DoS) attacks by flushing or disabling cache mechanisms on high-traffic rental inventory pages, thereby increasing server load significantly."
}