EUVD-2026-84300
GHSA-93mx-gf2p-7gff
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Subscriber-level account
-
ExploitPOST action=toggle_cache to admin-ajax.php
-
ExecutionMissing capability/nonce check passes
-
ImpactPlugin cache setting toggled without authorization
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target WordPress site to have the RW Elephant Rental Inventory plugin (version ≤2.3.13) installed and active, and the attacker must hold at least a Subscriber-level authenticated account (PR:L) - so sites permitting open user registration are most exposed. Exploitation is a single POST to /wp-admin/admin-ajax.php with the toggle_cache action; no user interaction is needed (UI:N). What limits it: the low privilege still must be obtained, and the impact is confined to flipping one cache setting (I:L), with no confidentiality or availability effect. The additionally-missing nonce means a logged-in higher-privileged user could also be tricked via CSRF. |
| Impact | This is a genuinely low-severity issue and the CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately reflects that. The only impact metric is I:L: an authenticated Subscriber-level user can flip the plugin's cache setting on or off via the wp_ajax_toggle_cache AJAX action, which lacks both a capability check (CWE-862) and nonce verification. There is no confidentiality (C:N) or availability (A:N) impact, and no path to data disclosure, privilege escalation, or code execution described. No EPSS score, KEV listing, or public POC is provided in the input, so exploitation-probability signals are absent rather than conflicting. PR:L requires a valid low-privilege account, which meaningfully limits real-world exploitability against sites that do not allow open/subscriber registration. Net: a low real-world priority - a minor authorization/CSRF-adjacent defect (nonce also missing) with trivial functional impact, not a high-severity concern despite the network attack vector. No signals conflict; the primary caveat is simply the low prevalence of the affected plugin. |
| Exploit ScenarioDerived | An attacker registers or obtains a Subscriber-level account on a WordPress site running RW Elephant Rental Inventory ≤2.3.13, then sends a crafted POST request to /wp-admin/admin-ajax.php with action=toggle_cache. Because the toggle_cache() handler performs no capability check and no nonce verification, the plugin's cache setting is toggled without authorization. No public exploit code is identified at time of analysis; the missing nonce also makes a CSRF variant plausible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Missing authorization in the RW Elephant Rental Inventory plugin for WordPress (all versions up to and including 2.3.13) lets an authenticated attacker with only Subscriber-level access flip the plugin's cache setting on or off by sending a single POST of the toggle_cache action to /wp-admin/admin-ajax.php. The AJAX handler performs neither a capability check nor a nonce check, so the same endpoint can additionally be driven by cross-site request forgery against a higher-privileged logged-in user. The impact is confined to a low-integrity configuration change (no confidentiality or availability effect), no public exploit code has been identified at time of analysis, and the assessed CVSS 4.3 reflects a genuinely low-severity issue.
RemediationAI
Upgrade the RW Elephant Rental Inventory plugin beyond the affected range immediately; the upstream code fix is contained in Trac changeset 3551183 (https://plugins.trac.wordpress.org/changeset/3551183), though a specific tagged release version containing it is not independently confirmed in the available data - so validate the installed version against the vendor's release notes or the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5e46beca-e33b-4ed9-a0ab-612a6987174e?source=cve before considering the site remediated. If upgrading cannot be done promptly, the most effective compensating control is to eliminate the Subscriber population that can reach the endpoint: close self-service registration (Settings > General > Membership) and audit existing low-privileged accounts, accepting that legitimate Subscriber self-service functionality will be lost. Sites that do not need the plugin's cache toggle can deactivate the plugin outright. Because the handler also lacks nonce verification, higher-privileged users remain CSRF-exposed even if Subscribers are removed, so administrators and editors should avoid browsing untrusted pages while logged in and should log out when idle; browser-level SameSite cookie enforcement on modern WordPress reduces but does not eliminate this path. If a custom mu-plugin is used to wrap the toggle_cache action with a current_user_can('manage_options') check, note that it must be maintained across plugin updates and can break legitimate admin toggling if the capability used is wrong.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RW Elephant Rental Inventory is a WordPress plugin whose options handling code lives in lib/classes/class-options.php. The vulnerable function, toggle_cache(), is registered as the handler for the wp_ajax_toggle_cache hook (referenced at line 75 of that file, with the handler body referenced at line 1524 in both trunk and the 2.3.11 tag). Because WordPress only dispatches wp_ajax_* actions to authenticated sessions, any logged-in user - including the lowest-privileged Subscriber role - can reach the handler. The code never calls current_user_can() to confirm the caller holds an administrative capability, and it never calls check_ajax_referer()/wp_verify_nonce(), which maps to CWE-862 (Missing Authorization) with a secondary CSRF exposure. The CPE cpe:2.3:a:rwelephant01:rw_elephant_rental_inventory:*:*:*:*:*:*:*:* uses a wildcard version, consistent with the advisory statement that every release through 2.3.13 is affected; the referenced Trac changeset 3551183 shows the upstream code change that adds the missing guard.
Know when Rw Elephant Rental Inventory gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Remote AJAX endpoint (AV:N/AC:L), requires a Subscriber account (PR:L), no interaction (UI:N); only a low-value config toggle so I:L, with C:N/A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the toggle_cache() function which is hooked to the wp_ajax_toggle_cache AJAX action. The function also lacks nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to toggle the plugin's cache setting on or off by sending a POST request to admin-ajax.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB