CVE-2026-9185: 6Storage Rentals <= 2.22.0 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Disclosure and Modification via 'userId' Parameter
The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.22.0 via the userId parameter of the sixstoragegetuserinfo and sixstorageupdateprofile AJAX actions. This is due to the sixstoragegetUserInfo() and sixstorageupdateProfile() functions being registered on wpajaxnopriv hooks and accepting a tenant identifier directly from $POST['userId'] without performing any ownership verification, session binding, or nonce validation to confirm the requester has a legitimate relationship to the supplied ID. This makes it possible for unauthenticated attackers to read and modify arbitrary tenants' profile data — including name, email address, phone number, physical address, and SSN — by supplying an enumerated userId value in a crafted request to either handler.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress 6Storage Rentals pluginto a version that resolves this vulnerability.Fixed in 2.22.0 - Configuration
Restrict the `six_storage_get_user_info` and `six_storage_update_profile` AJAX handlers so they are not registered on `wp_ajax_nopriv_*` (unauthenticated) hooks; require authenticated requests and ensure ownership verification/session binding/nonce validation before using `$_POST['userId']`.
WordPress 6Storage Rentals plugin (AJAX actions: six_storage_get_user_info, six_storage_update_profile) wp_ajax_nopriv_* hook usage / unauthenticated access = Use authenticated hooks (remove wp_ajax_nopriv_ registration)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9185?
CVE-2026-9185 has a severity rating of high, with a score of 7.5.
How do I fix CVE-2026-9185?
To fix CVE-2026-9185, update the 6Storage Rentals plugin to version 2.22.1 or later.
What types of vulnerabilities are associated with CVE-2026-9185?
CVE-2026-9185 is associated with unauthenticated insecure direct object references, allowing unauthorized access to user information.
What impact does CVE-2026-9185 have on users?
CVE-2026-9185 can lead to arbitrary user information disclosure and potential modification by attackers.
Which versions of 6Storage Rentals are affected by CVE-2026-9185?
All versions of 6Storage Rentals up to and including 2.22.0 are affected by CVE-2026-9185.