EUVD-2026-58840
GHSA-q5fr-2gmw-7f29
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote, unauthenticated, single-request session hijack of any account with no user interaction yields full C/I/A compromise; only knowing a target email is needed, keeping AC low.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_create_wp_user() AJAX handler being registered on wp_ajax_nopriv_six_storage_create_wp_user without any nonce, capability, credential, or ownership verification, while calling wp_set_current_user() and wp_set_auth_cookie() for any WordPress user resolved by the attacker-supplied email address. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting that user's email address.
Articles & Coverage 1
AnalysisAI
Authentication bypass in the 6Storage Rentals WordPress plugin (versions up to and including 2.27.0) lets unauthenticated attackers log in as any existing WordPress account, including administrators, simply by submitting the victim's email address. The flaw stems from the six_storage_create_wp_user() AJAX handler being exposed to unauthenticated callers while it silently establishes an authenticated session for the resolved user. No public exploit has been identified at time of analysis, but exploitation is trivial and the CVSS score of 9.8 reflects full compromise via a single crafted request.
Technical ContextAI
The vulnerability lives in a self-registration/user-provisioning AJAX endpoint of the plugin (Six_Storage_DashboardController). In WordPress, AJAX actions hooked on wp_ajax_nopriv_{action} are intentionally reachable by unauthenticated visitors, while the wp_ajax_{action} variant serves logged-in users. Here the handler six_storage_create_wp_user() is bound to wp_ajax_nopriv_six_storage_create_wp_user, meaning anyone can invoke it. Critically it performs no nonce (CSRF/intent) check, no capability check, no password/credential validation, and no ownership verification, yet it resolves a WordPress user from the attacker-supplied email and then calls wp_set_current_user() followed by wp_set_auth_cookie(), the two core WordPress functions that mint a valid authenticated session cookie for that user. This is a textbook CWE-287 (Improper Authentication) failure: identity is asserted from an unverified attacker-controlled parameter and a session is issued without any proof of that identity.
RemediationAI
No vendor-released patch identified at time of analysis; no fixed version above 2.27.0 is present in the provided data, so first verify current status via the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/94e987be-bdfc-4691-b250-2b7d7249df0a?source=cve) and the plugin's WordPress.org page, and upgrade immediately if a release beyond 2.27.0 is published. Until a patched version is confirmed, the highest-assurance control is to deactivate and remove the 6Storage Rentals plugin, accepting loss of rental-management functionality. If the plugin must stay active, apply compensating controls: use a WAF or web-server rule (or a WordPress security plugin) to block unauthenticated POSTs to /wp-admin/admin-ajax.php where action=six_storage_create_wp_user, noting this may break legitimate self-service user creation; restrict admin-ajax.php access by IP where feasible; and, because the attack yields an authenticated session, rotate/invalidate existing sessions and force password resets for administrator accounts, plus enforce strong two-factor authentication so a hijacked cookie is less useful. Also reduce email discoverability by disabling REST/author enumeration and avoiding publicly exposed admin email addresses.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today