Executive brief
The 6Storage Rentals WordPress plugin contains a critical authentication flaw that allows an unauthenticated attacker to log in as any WordPress user, including site administrators. An attacker can hijack any user account by simply knowing the user's email address, gaining full control over the WordPress site. This poses an immediate risk to site availability, data security, and operational integrity.
Technical details
The vulnerability is an authentication bypass in the six_storage_create_wp_user() AJAX handler, registered via wp_ajax_nopriv_six_storage_create_wp_user without any nonce, capability, or credential verification. The handler calls wp_set_current_user() and wp_set_auth_cookie() based on an attacker-supplied email address, allowing session hijacking of any existing WordPress user. No authentication or authorization checks are performed, making the endpoint accessible to unauthenticated users. An attacker need only submit a target user's email address to impersonate that user. Patches are available in versions after 2.27.0.
Affected products
- 6Storage Rentals up to and including 2.27.0
Timeline
- 2026-08-15: disclosed
- 2026-08-15: advisory: CVE-2026-15303 published