CVE-2026-15303
Received Received - Intake

Authentication Bypass in 6Storage Rentals WordPress Plugin

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: Wordfence

Description
The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_create_wp_user() AJAX handler being registered on wp_ajax_nopriv_six_storage_create_wp_user without any nonce, capability, credential, or ownership verification, while calling wp_set_current_user() and wp_set_auth_cookie() for any WordPress user resolved by the attacker-supplied email address. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting that user's email address.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-15303
EUVD
EUVD-2026-58840

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
6storage rentals to 2.27.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The 6Storage Rentals plugin for WordPress has an authentication bypass vulnerability in versions up to 2.27.0. The plugin's AJAX handler six_storage_create_wp_user() allows unauthenticated attackers to log in as any WordPress user by submitting their email address. This occurs because the handler calls wp_set_current_user() and wp_set_auth_cookie() without verifying nonce, capability, credential, or ownership.

Detection Guidance

Check WordPress plugin versions for '6Storage Rentals' up to 2.27.0. Look for unauthorized user creation logs or unexpected admin logins. Review AJAX handler calls to wp_ajax_nopriv_six_storage_create_wp_user without proper authentication.

Impact Analysis

This vulnerability allows attackers to gain unauthorized access to any WordPress account, including administrator accounts. Once logged in, attackers can take full control of the website, modify content, steal data, install malware, or perform other malicious actions without detection.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR and HIPAA compliance requirements. It may result in data breaches, unauthorized data exposure, or loss of control over personal health information, leading to legal penalties and reputational damage.

Mitigation Strategies

Update the 6Storage Rentals plugin to the latest version. Disable the plugin if no update is available. Remove the vulnerable AJAX handler or implement nonce and capability checks. Monitor for unauthorized user creation or admin access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15303. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart