Executive brief
The RW Elephant Rental Inventory WordPress plugin fails to properly authorize users before allowing them to toggle the plugin's cache settings via AJAX requests. An attacker with a basic Subscriber account can manipulate the plugin's cache functionality by sending a specially crafted request, potentially affecting site performance or exposing cached data.
Technical details
The toggle_cache() function hooked to the wp_ajax_toggle_cache AJAX action lacks capability checks and nonce verification, allowing any authenticated user with Subscriber or higher privileges to invoke cache toggle operations. This missing authorization check on a privileged administrative function permits privilege escalation attacks where low-privileged authenticated users modify plugin configuration.
Affected products
- RW Elephant Rental Inventory up to and including 2.3.13
Timeline
- 2026-09-22: disclosed