Description

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_create_wp_user() AJAX handler being registered on wp_ajax_nopriv_six_storage_create_wp_user without any nonce, capability, credential, or ownership verification, while calling wp_set_current_user() and wp_set_auth_cookie() for any WordPress user resolved by the attacker-supplied email address. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting that user's email address.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-15T03:16:47.670Z",
  "pubdate": "2026-08-15T03:16:47.670Z",
  "executiveSummary": "The 6Storage Rentals plugin for WordPress in versions up to, and including, 2.27.0 is vulnerable to an authentication bypass vulnerability. The flaw exists due to the improper implementation of an AJAX handler that lacks critical security checks.\nUnauthenticated remote attackers can exploit this vulnerability to log in as any existing WordPress user, including high-privileged accounts such as administrators, simply by supplying the target user's email address.\nSuccessful exploitation results in total account takeover and complete compromise of the affected WordPress site, allowing malicious actors to execute arbitrary administrative actions, modify system configurations, and deploy further persistence mechanisms.\nThe risk implications are critical because the vulnerability requires no prior authentication, special capabilities, or user interaction, lowering the barrier to entry for potential attackers to achieve full system compromise.",
  "technicalDetails": "The vulnerability resides in the 6Storage Rentals plugin, specifically within the six_storage_create_wp_user() AJAX handler. This function is improperly registered on the wp_ajax_nopriv_six_storage_create_wp_user hook, making it accessible to unauthenticated network requests without requiring any valid session or administrative privileges.\nThe root cause of the flaw is the complete absence of security mechanisms, including cryptographic nonce verification, capability checks, credential validation, or ownership verification within the handler logic.\nDuring execution, the vulnerable function processes an attacker-supplied email address, resolves it to a corresponding WordPress user account, and directly invokes wp_set_current_user() and wp_set_auth_cookie() for that resolved user.\nThe attack flow proceeds as follows: First, an unauthenticated attacker identifies or targets a valid user account on the WordPress site, such as an administrator, by obtaining their email address. Second, the attacker sends an HTTP POST request to the WordPress AJAX endpoint targeting the six_storage_create_wp_user action, supplying the targeted email address as a parameter. Third, the plugin processes the request without validating the sender's identity or authorization. Fourth, the application resolves the email address to the corresponding user entity and programmatically authenticates the session via wp_set_auth_cookie(). Finally, the attacker receives a valid authentication cookie, granting them immediate, privileged access to the victim's account.\nThe affected component is the six_storage_create_wp_user() function across all plugin versions up to, and including, 2.27.0. The attack vector is entirely network-based, requires zero authentication or user interaction, and yields post-exploitation impact equivalent to full administrative takeover of the WordPress instance."
}