CVE-2026-15303: 6Storage Rentals <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter
The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the sixstoragecreatewpuser() AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownership verification, while calling wpsetcurrentuser() and wpsetauthcookie() for any WordPress user resolved by the attacker-supplied email address. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting that user's email address.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: 6Storage Rentalsto a version that resolves this vulnerability.Fixed in 2.27.0 - Compensating control
Restrict access to the unauthenticated AJAX endpoint wp_ajax_nopriv_six_storage_create_wp_user (e.g., via firewall/WAF/ACL or other network controls) to prevent unauthenticated exploitation until patched.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15303?
CVE-2026-15303 has a critical severity rating of 9.8.
How do I fix CVE-2026-15303?
To fix CVE-2026-15303, update the 6Storage Rentals plugin to version 2.27.1 or later.
What type of vulnerability is CVE-2026-15303?
CVE-2026-15303 is an unauthenticated account takeover vulnerability.
Which versions are affected by CVE-2026-15303?
CVE-2026-15303 affects all 6Storage Rentals plugin versions up to and including 2.27.0.
What causes CVE-2026-15303?
CVE-2026-15303 is caused by an authentication bypass due to the lack of nonce and other security checks in the AJAX handler.