CVE-2026-15303criticalCWE-287

CVE-2026-15303: critical vulnerability in sixstorage 6Storage Rentals

6Storage Rentals <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter

Published · Updated

Follow this CVE+ Monitor 6Storage Rentals

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.8%
The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_create_wp_user() AJAX handler being registered on wp_ajax_nopriv_six_storage_create_wp_user without any nonce, capability, credential, or ownership verification, while calling wp_set_current_user() and wp_set_auth_cookie() for any WordPress user resolved by the attacker-supplied email address. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting that user's email address.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
sixstorage · 6Storage Rentals
Related CVEs — sixstorage 6Storage Rentals

In the same product, most dangerous first.

CVE-2026-9185HIGH6Storage Rentals <= 2.22.0 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Disclosure and Modification via 'userId' ParameterEPSS 0.4%