Authentication Bypass in 6Storage Rentals Plugin for WordPress

CVE-2026-103883

What is CVE-2026-103883?

The 6Storage Rentals plugin for WordPress contains a significant security flaw that allows authenticated attackers to bypass authentication mechanisms and gain unauthorized access to any existing user account, including those of administrators. The vulnerability stems from the six_storage_portal_registration() AJAX handler, which fails to enforce necessary capability checks or nonce verifications. As a result, attackers with Subscriber-level access can manipulate the six_storage_online_api_url parameter, ultimately allowing them to create a transient that can authenticate as any user. This issue presents a serious risk, given that it enables account takeovers and full site compromises without adequate verification of ownership or credentials.

References