6Storage Rentals
Monthly
Authentication bypass in the 6Storage Rentals WordPress plugin (versions up to and including 2.27.0) lets unauthenticated attackers log in as any existing WordPress account, including administrators, simply by submitting the victim's email address. The flaw stems from the six_storage_create_wp_user() AJAX handler being exposed to unauthenticated callers while it silently establishes an authenticated session for the resolved user. No public exploit has been identified at time of analysis, but exploitation is trivial and the CVSS score of 9.8 reflects full compromise via a single crafted request.
Unauthenticated tenant data disclosure in the 6Storage Rentals WordPress plugin (versions up to and including 2.22.0) allows remote attackers to read and modify arbitrary tenant profile records - including names, emails, phone numbers, physical addresses, and SSNs - by enumerating numeric userId values. The flaw stems from AJAX handlers exposed via wp_ajax_nopriv_* hooks without ownership checks or nonce validation. No public exploit identified at time of analysis, but the bug is trivially scriptable and reported by Wordfence.
Authentication bypass in the 6Storage Rentals WordPress plugin (versions up to and including 2.27.0) lets unauthenticated attackers log in as any existing WordPress account, including administrators, simply by submitting the victim's email address. The flaw stems from the six_storage_create_wp_user() AJAX handler being exposed to unauthenticated callers while it silently establishes an authenticated session for the resolved user. No public exploit has been identified at time of analysis, but exploitation is trivial and the CVSS score of 9.8 reflects full compromise via a single crafted request.
Unauthenticated tenant data disclosure in the 6Storage Rentals WordPress plugin (versions up to and including 2.22.0) allows remote attackers to read and modify arbitrary tenant profile records - including names, emails, phone numbers, physical addresses, and SSNs - by enumerating numeric userId values. The flaw stems from AJAX handlers exposed via wp_ajax_nopriv_* hooks without ownership checks or nonce validation. No public exploit identified at time of analysis, but the bug is trivially scriptable and reported by Wordfence.