Junglewise Threat Intelligence

CVE-2026-9185: 6Storage Rentals WordPress plugin authorization bypass in AJAX actions

CVE-2026-9185 · Severity: high · CVSS 7.5 · Published 2026-06-09

Technologies: 6Storage Rentals. Vendors: 6Storage.

Executive brief

The 6Storage Rentals plugin for WordPress, which manages self-storage facility rentals and tenant accounts, contains a security flaw that allows unauthorized access to customer data. An attacker can exploit this to view or change sensitive information belonging to any tenant, including names, phone numbers, physical addresses, and Social Security Numbers. This could lead to significant data breaches, identity theft risks for customers, and reputational damage for the storage facility operator.

Technical details

The 6Storage Rentals plugin for WordPress (up to version 2.22.0) is vulnerable to an Insecure Direct Object Reference (IDOR) / Authorization Bypass via the 'userId' parameter. The functions 'six_storage_getUserInfo()' and 'six_storage_updateProfile()' are registered via 'wp_ajax_nopriv_*' hooks, making them accessible to unauthenticated users. Because the plugin fails to implement ownership verification, session binding, or nonce validation, an attacker can supply arbitrary user IDs in AJAX requests to the 'six_storage_get_user_info' and 'six_storage_update_profile' actions. This allows for the unauthorized retrieval and modification of tenant PII, including names, emails, phone numbers, addresses, and Social Security Numbers (SSN).

Affected products

  • 6Storage 6Storage Rentals up to and including 2.22.0

Timeline

  • 2026-06-09: disclosed: Initial publication of the CVE record.
  • 2026-06-09: advisory: Wordfence published the vulnerability details.

References