{"id":"CVE-2026-103883","kind":"vulnerability","aliases":["CVE-2026-103883"],"related":[],"title":"6Storage Rentals WordPress plugin: unauthenticated admin login takeover","description":"The 6Storage Rentals plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 2.31.0. The vulnerability exists because the `six_storage_portal_registration()` AJAX handler — registered on `wp_ajax_six_storage_portal_plugin_registration` — performs no capability check and no nonce verification before writing the caller-supplied `six_storage_online_api_url` POST parameter to the site-wide option of the same name; the unauthenticated `six_storage_create_wp_user()` handler then redeems a transient seeded from that attacker-controlled URL's response and unconditionally calls `wp_set_current_user()` and `wp_set_auth_cookie()` with no ownership or credential verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to authenticate as any existing WordPress user — including any administrator whose email address is known or guessable — resulting in full site compromise. This issue represents an incomplete fix for a prior vulnerability: the 2.29.0 remediation moved the target email out of POST data into a server-side transient, but because any Subscriber can still overwrite the outbound API URL that populates that transient, the full authentication bypass chain remains exploitable in three AJAX requests.","summary":"The 6Storage Rentals WordPress plugin up to and including 2.31.0 lets an attacker overwrite a stored API URL and then log in as any existing user, including administrators. The bypass chain needs three unauthenticated AJAX requests and gives full control of the WordPress site.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"6Storage Rentals","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["6storage-rentals","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the 6Storage Rentals plugin in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version`\n- Look for the option `six_storage_online_api_url` in the `wp_options` table","fix":"- 6Storage Rentals plugin: move to a version later than `2.31.0`; the fixed version is not stated in the sources","status":"open","published_at":"2026-11-11T12:18:14+00:00","first_seen_at":"2026-11-11T12:27:10+00:00","triaged_at":"2026-11-11T12:28:26+00:00","updated_at":"2026-11-11T12:28:26+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T12:28:26Z","model":"claude-haiku-5-5","output":{"fix":"- 6Storage Rentals plugin: move to a version later than `2.31.0`; the fixed version is not stated in the sources","reach":"internet","title":"6Storage Rentals WordPress plugin: unauthenticated admin login takeover","impact":"high","summary":"The 6Storage Rentals WordPress plugin up to and including 2.31.0 lets an attacker overwrite a stored API URL and then log in as any existing user, including administrators. The bypass chain needs three unauthenticated AJAX requests and gives full control of the WordPress site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","6storage-rentals","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker logs in as an administrator and takes over the whole site","analyst_note":"Confirm the fixed plugin version and whether a setting gates the AJAX handlers, using the NVD entry and the vendor's changelog.","how_to_check":"- Check the installed version of the 6Storage Rentals plugin in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version`\n- Look for the option `six_storage_online_api_url` in the `wp_options` table","plain_action":"","product_name":"6Storage Rentals","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Any WordPress site running the 6Storage Rentals plugin version 2.31.0 or earlier is exposed, because the AJAX handlers are reachable without a login. Sites that do not have this plugin installed are not affected. The sources do not say whether the flaw needs a specific plugin setting.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000812,"input_tokens":4893,"output_tokens":646,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-103883':11A,14A '-2026':10A,13A '2.29.0':230C '2.31.0':34B,92C '6storage':1A,15A,18B,26B,70C '6storage-rentals':17B 'access':194C 'account':83C 'address':209C 'admin':6A 'administr':52B,82C,206C 'ajax':59B,102C,107C,270C 'api':41B,130C,255C 'attack':37B,160C,189C 'attacker-control':159C 'auth':175C 'authent':78C,188C,198C,263C 'bypass':54B,79C,264C 'call':167C 'caller':125C 'caller-suppli':124C 'capabl':115C 'chain':55B,265C 'check':116C 'compromis':218C 'control':64B,161C 'cooki':176C 'creat':148C 'credenti':181C 'current':170C 'cve':9A,12A 'data':239C 'email':208C,235C 'exist':49B,95C,201C 'exploit':267C 'fix':224C 'full':63B,216C,262C 'give':62B 'guessabl':213C 'handler':103C,151C 'host':23B 'includ':33B,51B,91C,204C 'incomplet':223C 'issu':220C 'known':211C 'lead':80C 'let':35B 'level':193C 'log':45B 'login':7A 'make':184C 'move':232C 'name':143C 'need':56B 'nonc':119C 'onlin':129C 'option':139C 'outbound':254C 'overwrit':38B,252C 'ownership':179C 'packag':20B 'paramet':133C 'perform':113C 'plugin':4A,29B,72C,111C 'popul':258C 'portal':100C,110C 'possibl':186C 'post':132C,238C 'prior':227C 'redeem':153C 'regist':104C 'registr':101C,112C 'remain':266C 'remedi':231C 'rental':2A,19B,27B,71C 'rentals':16A 'repres':221C 'request':60B,271C 'respons':164C 'result':214C 'seed':156C 'self':22B 'self-host':21B 'server':243C 'server-sid':242C 'set':169C,174C 'side':244C 'site':68B,137C,217C 'site-wid':136C 'six':98C,108C,127C,146C 'still':251C 'storag':99C,109C,128C,147C 'store':40B 'subscrib':192C,249C 'subscriber-level':191C 'suppli':126C 'takeov':8A,84C 'target':234C 'three':57B,269C 'transient':155C,245C,260C 'unauthent':5A,58B,145C 'uncondit':166C 'url':42B,131C,162C,256C 'user':50B,150C,171C,203C 'verif':120C,182C 'version':87C 'vulner':76C,94C,228C 'whose':207C 'wide':138C 'wordpress':3A,24B,28B,67B,74C,202C 'wp':106C,149C,168C,173C 'write':122C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the 6Storage Rentals plugin version 2.31.0 or earlier is exposed, because the AJAX handlers are reachable without a login. Sites that do not have this plugin installed are not affected. The sources do not say whether the flaw needs a specific plugin setting.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["6storagerentals","rentals"],"ptokens":["6storage","rentals"],"labels":["6storagerentals","high","package","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-103883':11A,14A '-2026':10A,13A '6storage':1A,15A 'admin':6A 'cve':9A,12A 'login':7A 'plugin':4A 'rental':2A 'rentals':16A 'takeov':8A 'unauthent':5A 'wordpress':3A","search_b":"'2.31.0':34B '6storage':18B,26B '6storage-rentals':17B 'administr':52B 'ajax':59B 'api':41B 'attack':37B 'bypass':54B 'chain':55B 'control':64B 'exist':49B 'full':63B 'give':62B 'host':23B 'includ':33B,51B 'let':35B 'log':45B 'need':56B 'overwrit':38B 'packag':20B 'plugin':29B 'rental':19B,27B 'request':60B 'self':22B 'self-host':21B 'site':68B 'store':40B 'three':57B 'unauthent':58B 'url':42B 'user':50B 'wordpress':24B,28B,67B","search_c":"'2.29.0':230C '2.31.0':92C '6storage':70C 'access':194C 'account':83C 'address':209C 'administr':82C,206C 'ajax':102C,107C,270C 'api':130C,255C 'attack':160C,189C 'attacker-control':159C 'auth':175C 'authent':78C,188C,198C,263C 'bypass':79C,264C 'call':167C 'caller':125C 'caller-suppli':124C 'capabl':115C 'chain':265C 'check':116C 'compromis':218C 'control':161C 'cooki':176C 'creat':148C 'credenti':181C 'current':170C 'data':239C 'email':208C,235C 'exist':95C,201C 'exploit':267C 'fix':224C 'full':216C,262C 'guessabl':213C 'handler':103C,151C 'includ':91C,204C 'incomplet':223C 'issu':220C 'known':211C 'lead':80C 'level':193C 'make':184C 'move':232C 'name':143C 'nonc':119C 'onlin':129C 'option':139C 'outbound':254C 'overwrit':252C 'ownership':179C 'paramet':133C 'perform':113C 'plugin':72C,111C 'popul':258C 'portal':100C,110C 'possibl':186C 'post':132C,238C 'prior':227C 'redeem':153C 'regist':104C 'registr':101C,112C 'remain':266C 'remedi':231C 'rental':71C 'repres':221C 'request':271C 'respons':164C 'result':214C 'seed':156C 'server':243C 'server-sid':242C 'set':169C,174C 'side':244C 'site':137C,217C 'site-wid':136C 'six':98C,108C,127C,146C 'still':251C 'storag':99C,109C,128C,147C 'subscrib':192C,249C 'subscriber-level':191C 'suppli':126C 'takeov':84C 'target':234C 'three':269C 'transient':155C,245C,260C 'unauthent':145C 'uncondit':166C 'url':131C,162C,256C 'user':150C,171C,203C 'verif':120C,182C 'version':87C 'vulner':76C,94C,228C 'whose':207C 'wide':138C 'wordpress':74C,202C 'wp':106C,149C,168C,173C 'write':122C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103883","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103883","severity":null,"published_at":"2026-11-11T12:18:14+00:00","modified_at":"2026-11-11T12:18:14+00:00","first_seen_at":"2026-11-11T12:27:10+00:00","fetched_at":"2026-11-11T12:27:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}