EUVD-2026-35307
GHSA-q4cx-mm7j-89xj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.22.0 via the userId parameter of the six_storage_get_user_info and six_storage_update_profile AJAX actions. This is due to the six_storage_getUserInfo() and six_storage_updateProfile() functions being registered on wp_ajax_nopriv_* hooks and accepting a tenant identifier directly from $_POST['userId'] without performing any ownership verification, session binding, or nonce validation to confirm the requester has a legitimate relationship to the supplied ID. This makes it possible for unauthenticated attackers to read and modify arbitrary tenants' profile data - including name, email address, phone number, physical address, and SSN - by supplying an enumerated userId value in a crafted request to either handler.
Articles & Coverage 2
AnalysisAI
Unauthenticated tenant data disclosure in the 6Storage Rentals WordPress plugin (versions up to and including 2.22.0) allows remote attackers to read and modify arbitrary tenant profile records - including names, emails, phone numbers, physical addresses, and SSNs - by enumerating numeric userId values. The flaw stems from AJAX handlers exposed via wp_ajax_nopriv_* hooks without ownership checks or nonce validation. No public exploit identified at time of analysis, but the bug is trivially scriptable and reported by Wordfence.
Technical ContextAI
The vulnerability is a textbook CWE-639 (Authorization Bypass Through User-Controlled Key), also known as Insecure Direct Object Reference (IDOR). The 6Storage Rentals plugin is a self-storage facility management add-on for WordPress that exposes tenant management functionality. Per Wordfence's analysis and the plugins.trac source references, the functions six_storage_getUserInfo() and six_storage_updateProfile() in Six_Storage_DashboardController.php are registered on the wp_ajax_nopriv_* hook family, which WordPress uses to expose AJAX endpoints to unauthenticated visitors. Both handlers read $_POST['userId'] directly as the tenant key and look up or modify the corresponding record without binding the request to an authenticated session, validating a nonce, or checking that the caller owns the supplied identifier. The affected CPE is cpe:2.3:a:sixstorage:6storage_rentals:*:*:*:*:*:*:*:* across all versions through 2.22.0.
RemediationAI
No vendor-released patch identified at time of analysis - the references point only to vulnerable versions 2.20.2 and 2.22.0 on plugins.trac, with no fixed release linked. Site operators should immediately deactivate and remove the 6Storage Rentals plugin until a patched version is published, monitoring the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/74fa4240-6f62-4db6-b7e7-56998fc29e42?source=cve and the plugin's WordPress.org page for a fix. As compensating controls while waiting, block the six_storage_get_user_info and six_storage_update_profile admin-ajax.php actions at the web server or WAF layer (e.g., reject POSTs to /wp-admin/admin-ajax.php where action matches those names and the request is unauthenticated), which will break the tenant self-service portal but stop exploitation; alternatively, restrict /wp-admin/admin-ajax.php to authenticated sessions via reverse-proxy auth, which will break any other nopriv AJAX flows on the site. Given SSN exposure, operators should also review web server logs for prior enumeration of POST parameter userId against admin-ajax.php and prepare breach-notification procedures if hits are found.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today