CVE-2026-4123: WordPress RW Elephant Rental Plugin Bypass

CVE-2026-4123 Overview

CVE-2026-4123 is a Missing Authorization vulnerability [CWE-862] in the RW Elephant Rental Inventory plugin for WordPress. The flaw affects all versions up to and including 2.3.13. The toggle_cache() function, hooked to the wp_ajax_toggle_cache AJAX action, lacks both a capability check and nonce verification. Authenticated users with Subscriber-level access or higher can toggle the plugin's cache setting by sending a crafted POST request to admin-ajax.php.

Critical Impact

Any authenticated WordPress user, including low-privileged Subscribers, can modify the plugin's cache configuration without authorization, impacting the integrity of plugin settings.

Affected Products

• RW Elephant Rental Inventory plugin for WordPress
• All versions up to and including 2.3.13
• WordPress installations exposing the wp_ajax_toggle_cache AJAX endpoint

Discovery Timeline

• 2026-09-22 - CVE-2026-4123 published to the National Vulnerability Database (NVD)
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-4123

Vulnerability Analysis

The vulnerability resides in the toggle_cache() function within lib/classes/class-options.php of the RW Elephant Rental Inventory plugin. The function is registered to the wp_ajax_toggle_cache action, which WordPress exposes to any authenticated user via admin-ajax.php. The handler executes the cache toggle logic without validating whether the requesting user holds an administrative capability such as manage_options.

A related deficiency is the absence of nonce verification. Without a nonce check, the endpoint does not confirm that the request originated from a legitimate administrative workflow. Combined with the missing capability check, this allows any user session, from Subscriber upward, to invoke the action successfully.

The impact is limited to modification of a plugin configuration setting. It does not directly enable code execution, data exfiltration, or account takeover, which is reflected in the low integrity impact and absence of confidentiality or availability impact.

Root Cause

The root cause is a missing authorization control in a WordPress AJAX handler. The toggle_cache() function assumes the caller is privileged because the hook uses the wp_ajax_ prefix, but that prefix only requires authentication, not authorization. A proper implementation must call current_user_can() and check_ajax_referer() before performing state-changing operations.

Attack Vector

Exploitation requires an authenticated WordPress account of at least Subscriber level. The attacker sends a POST request to /wp-admin/admin-ajax.php with the action parameter set to toggle_cache. Because no nonce is validated and no capability is enforced, the server processes the request and flips the cache setting. Refer to the Wordfence Vulnerability Analysis and the affected source code for the vulnerable handler location.

Detection Methods for CVE-2026-4123

Indicators of Compromise

• POST requests to /wp-admin/admin-ajax.php containing action=toggle_cache originating from non-administrative user sessions.
• Unexpected changes to the RW Elephant Rental Inventory plugin's cache option in the wp_options table.
• Access log entries showing the toggle_cache action followed by HTTP 200 responses for Subscriber-level accounts.

Detection Strategies

• Enable WordPress audit logging to capture AJAX actions and the user role associated with each request.
• Correlate admin-ajax.php traffic against user roles to flag privileged actions invoked by low-privilege accounts.
• Deploy a Web Application Firewall (WAF) rule to alert on action=toggle_cache requests missing a valid administrator session or nonce.

Monitoring Recommendations

• Monitor plugin option changes with file-integrity or database-integrity tooling on production WordPress hosts.
• Track newly registered Subscriber accounts, especially on sites that allow open registration, and correlate with AJAX activity.
• Review WordPress plugin inventory regularly and subscribe to the Wordfence threat intelligence feed for updates.

How to Mitigate CVE-2026-4123

Immediate Actions Required

• Update the RW Elephant Rental Inventory plugin to a version later than 2.3.13 once available from the vendor.
• Audit existing WordPress user accounts and remove or downgrade unnecessary Subscriber-level accounts.
• Disable open user registration if it is not required for site functionality.

Patch Information

A code fix is tracked in the WordPress plugin repository under changeset 3551183. Administrators should install the first stable release that incorporates this changeset. Review the updated source in trunk to confirm the authorization and nonce checks are present before deploying.

Workarounds

• Deactivate the RW Elephant Rental Inventory plugin until a patched version is installed.
• Apply a WAF rule that blocks POST requests to admin-ajax.php where action=toggle_cache and the session lacks administrator privileges.
• Restrict access to /wp-admin/ at the web server or reverse proxy layer to trusted source IP addresses where practical.

# Example ModSecurity rule to block unauthorized toggle_cache invocations
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1004123,\
    msg:'CVE-2026-4123 - Block unauthenticated toggle_cache AJAX'"
    SecRule ARGS:action "@streq toggle_cache" \
        "chain"
        SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"