CVE-2026-4123

MediumCVSS 4.3/10Last modified Sep 22, 2026

Description

The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the toggle_cache() function which is hooked to the wp_ajax_toggle_cache AJAX action. The function also lacks nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to toggle the plugin's cache setting on or off by sending a POST request to admin-ajax.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
rwelephant01RW Elephant Rental Inventory<= 2.3.13

References

Timeline

Published
Sep 22, 2026
Last modified
Sep 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-412308.5Froxlor is open source server administration software. Prior to version 2.3.6, `DomainZones::add()` accepts arbitrary DNS record types withoCVE-2026-412317.5Froxlor is open source server administration software. Prior to version 2.3.6, `DataDump.add()` constructs the export destination path from CVE-2026-412325.0Froxlor is open source server administration software. Prior to version 2.3.6, in `EmailSender::add()`, the domain ownership validation for CVE-2026-412335.4Froxlor is open source server administration software. Prior to version 2.3.6, in `Domains.add()`, the `adminid` parameter is accepted from CVE-2026-412347.6Froxlor is open source server administration software. Prior to version 2.3.7, the `DomainZones.add` API endpoint does not sanitize newline CVE-2026-412358.6Froxlor is open source server administration software. Version 2.3.6 lets administrators configure `system.available_shells` as the approvedCVE-2026-412368.8Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronizaCVE-2026-412378.6Froxlor is open source server administration software. In version 2.3.6 and earlier, the LOC record regex uses `\s+` which matches newlines CVE-2026-412386.9DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototypeCVE-2026-412396.8DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SACVE-2026-41245.4The Ziggeo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1. The wp_ajax_ziggeo_ajax CVE-2026-412406.1DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORB
CVE-2026-4123: Medium severity, CVSS 4.3 | Vulnix