---
id: "CVE-2026-103883"
page: "https://infrastack.ai/live/CVE-2026-103883"
kind: "vulnerability"
aliases: ["CVE-2026-103883"]
title: "6Storage Rentals WordPress plugin: unauthenticated admin login takeover"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "6Storage Rentals", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["6storage-rentals", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-11T12:18:14+00:00"
first_seen_at: "2026-11-11T12:27:10+00:00"
updated_at: "2026-11-11T12:28:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103883", "first_seen_at": "2026-11-11T12:27:10+00:00"}]
exploit_sources: []
---

# 6Storage Rentals WordPress plugin: unauthenticated admin login takeover

Link for people: https://infrastack.ai/live/CVE-2026-103883 (this .md is for agents)

The 6Storage Rentals WordPress plugin up to and including 2.31.0 lets an attacker overwrite a stored API URL and then log in as any existing user, including administrators. The bypass chain needs three unauthenticated AJAX requests and gives full control of the WordPress site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:6Storage Rentals affected range not listed fixed no fixed version listed

## How to check

- Check the installed version of the 6Storage Rentals plugin in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version`
- Look for the option `six_storage_online_api_url` in the `wp_options` table

## Fix

- 6Storage Rentals plugin: move to a version later than `2.31.0`; the fixed version is not stated in the sources

## Timeline

- 2026-11-11T12:27:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103883

## From the sources

The 6Storage Rentals plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 2.31.0. The vulnerability exists because the `six_storage_portal_registration()` AJAX handler — registered on `wp_ajax_six_storage_portal_plugin_registration` — performs no capability check and no nonce verification before writing the caller-supplied `six_storage_online_api_url` POST parameter to the site-wide option of the same name; the unauthenticated `six_storage_create_wp_user()` handler then redeems a transient seeded from that attacker-controlled URL's response and unconditionally calls `wp_set_current_user()` and `wp_set_auth_cookie()` with no ownership or credential verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to authenticate as any existing WordPress user — including any administrator whose email address is known or guessable — resulting in full site compromise. This issue represents an incomplete fix for a prior vulnerability: the 2.29.0 remediation moved the target email out of POST data into a server-side transient, but because any Subscriber can still overwrite the outbound API URL that populates that transient, the full authentication bypass chain remains exploitable in three AJAX requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_