The RW Elephant Rental Inventory plugin for WordPress contains a flaw where the toggle_cache() function is accessible via the wp_ajax_toggle_cache AJAX action without any capability or nonce checks. This flaw allows any authenticated user with Subscriber or higher role to send a POST request to the admin‑ajax endpoint and toggle the plugin’s cache setting on or off. While the change itself is a configuration alteration, it can disrupt normal site performance, potentially leading to degraded user experience or cache inconsistencies.

The vulnerability affects all installations of the RW Elephant Rental Inventory plugin on WordPress sites running version 2.3.13 or earlier. No other WordPress core components or plugins are directly impacted.

The CVSS score of 4.3 indicates a low to moderate severity. No EPSS score is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting a lower likelihood of widespread exploitation. The attack requires the attacker to be authenticated as a Subscriber or higher and to send a crafted POST request to admin‑ajax, which is technically trivial for a legitimate site user. The missing nonce further simplifies the exploitation process.