6Storage Rentals: Unauthenticated Authentication Bypass
6Storage Rentals WP plugin (≤2.27.0) sets auth cookies for arbitrary users via an unauthenticated AJAX handler, enabling full account takeover.
- Vendor
- 6Storage
- Product
- 6Storage Rentals for WordPress
- CVSS
- 9.8
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
The 6Storage Rentals plugin for WordPress (all versions through 2.27.0) registers a WordPress AJAX action, six_storage_create_wp_user, under the wp_ajax_nopriv_* hook — which makes it reachable by any unauthenticated visitor without any prior session or capability check. The handler accepts an email address from the POST body, resolves it to a WordPress user account via get_user_by('email', ...), and then calls wp_set_current_user() and wp_set_auth_cookie() unconditionally.
There is no nonce verification, no ownership check, and no capability gate on this handler. Any attacker who knows a registered user’s email address — including a site administrator’s — can supply it, receive a valid authenticated session cookie in the response, and operate with the full privileges of that account.
Affected versions: all versions through 2.27.0
Fixed in: update to the latest available release
What to do: Update immediately. Check the WordPress plugin repository for the current patched version. If your plugin manager does not yet show an update, disable the plugin until one is available.
See also: full write-up covering this and two related critical WordPress plugin flaws.
