Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-11
6storage Rentals - Security Vulnerability (CVE-2026-103883)
The 6Storage Rentals plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 2.31.0. The vulnerability exists because the `six_storage_portal_registration()` AJAX handler — registered on `wp_ajax_six_storage_portal_plugin_registration` — performs no capability check and no nonce verification before writing the caller-supplied `six_storage_online_api_url` POST parameter to the site-wide option of the same name; the unauthenticated `six_storage_create_wp_user()` handler then redeems a transient seeded from that attacker-controlled URL's response and unconditionally calls `wp_set_current_user()` and `wp_set_auth_cookie()` with no ownership or credential verification. This makes it possible…
PLUGIN
6storage Rentals
CVE-2026-103883
Risk Score
Threat Entry
Updated 2026-08-20
6storage Rentals - Authentication Bypass (CVE-2026-15303)
The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_create_wp_user() AJAX handler being registered on wp_ajax_nopriv_six_storage_create_wp_user without any nonce, capability, credential, or ownership verification, while calling wp_set_current_user() and wp_set_auth_cookie() for any WordPress user resolved by the attacker-supplied email address. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting that user's email address.
PLUGIN
6storage Rentals
CVE-2026-15303
Risk Score
Threat Entry
Updated 2026-07-23
6storage Rentals - Broken Access Control (CVE-2026-9185)
The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.22.0 via the `userId` parameter of the `six_storage_get_user_info` and `six_storage_update_profile` AJAX actions. This is due to the `six_storage_getUserInfo()` and `six_storage_updateProfile()` functions being registered on `wp_ajax_nopriv_*` hooks and accepting a tenant identifier directly from `$_POST['userId']` without performing any ownership verification, session binding, or nonce validation to confirm the requester has a legitimate relationship to the supplied ID. This makes it possible for unauthenticated attackers to read and modify arbitrary tenants'…
PLUGIN
6storage Rentals
CVE-2026-9185
Risk Score
Threat Entry
Updated 2026-06-17
6storage Rentals - Server-Side Request Forgery (SSRF) (CVE-2025-67623)
Server-Side Request Forgery (SSRF) vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Server Side Request Forgery.This issue affects 6Storage Rentals: from n/a through
PLUGIN
6storage Rentals
CVE-2025-67623
Risk Score
Threat Entry
Updated 2026-06-17
6storage Rentals - Broken Access Control (CVE-2023-26002)
Missing Authorization vulnerability in 6Storage 6Storage Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects 6Storage Rentals: from n/a through 2.19.5.
PLUGIN
6storage Rentals
CVE-2023-26002
Risk Score
Threat Entry
Updated 2026-06-17
6storage Rentals - Path Traversal (CVE-2025-47619)
Missing Authorization vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Path Traversal.This issue affects 6Storage Rentals: from n/a through
PLUGIN
6storage Rentals
CVE-2025-47619
Risk Score
Threat Entry
Updated 2026-06-17
6storage Rentals - Broken Access Control (CVE-2025-32178)
Missing Authorization vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 6Storage Rentals: from n/a through
PLUGIN
6storage Rentals
CVE-2025-32178
Risk Score