Is CVE-2026-9185 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9185 being exploited in the wild.

How severe is CVE-2026-9185?

High severity, with a CVSS score of 7.5, published 9 June 2026.

Which products and versions are affected?

6Storage Rentals up to and including 2.22.0.

Is there a fix for CVE-2026-9185?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9185 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9185?

Check whether you run 6Storage Rentals at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9185: 6Storage Rentals WordPress plugin authorization bypass in AJAX actions

CVE-2026-9185 · Severity: high · CVSS 7.5 · Published 2026-06-09

The 6Storage Rentals plugin for WordPress, which manages self-storage facility rentals and tenant accounts, contains a security flaw that allows unauthorized access to customer data. An attacker can exploit this to view or change sensitive information belonging to any tenant, including names, phone numbers, physical addresses, and Social Security Numbers. This could lead to significant data breaches, identity theft risks for customers, and reputational damage for the storage facility operator.

Technologies: 6Storage Rentals. Vendors: 6Storage.

Quick answers

Is CVE-2026-9185 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9185 being exploited in the wild.
How severe is CVE-2026-9185?: High severity, with a CVSS score of 7.5, published 9 June 2026.
Which products and versions are affected?: 6Storage Rentals up to and including 2.22.0.
Is there a fix for CVE-2026-9185?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9185 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9185?: Check whether you run 6Storage Rentals at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The 6Storage Rentals plugin for WordPress (up to version 2.22.0) is vulnerable to an Insecure Direct Object Reference (IDOR) / Authorization Bypass via the 'userId' parameter. The functions 'six_storage_getUserInfo()' and 'six_storage_updateProfile()' are registered via 'wp_ajax_nopriv_*' hooks, making them accessible to unauthenticated users. Because the plugin fails to implement ownership verification, session binding, or nonce validation, an attacker can supply arbitrary user IDs in AJAX requests to the 'six_storage_get_user_info' and 'six_storage_update_profile' actions. This allows for the unauthorized retrieval and modification of tenant PII, including names, emails, phone numbers, addresses, and Social Security Numbers (SSN).

Affected products

6Storage 6Storage Rentals up to and including 2.22.0

Timeline

2026-06-09: disclosed: Initial publication of the CVE record.
2026-06-09: advisory: Wordfence published the vulnerability details.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.