External risk intelligence

6Storage Rentals WordPress Plugin Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-15303

The vulnerability affects a WordPress plugin, which is typically deployed in internet-facing web application environments. The vulnerable AJAX handler is accessible via the web interface, making it reachable from the public internet in standard WordPress configurations.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the 6Storage Rentals WordPress plugin that could allow unauthorized individuals to bypass login procedures. This issue affects how the plugin handles user creation and authentication, potentially enabling access to any user account, including administrative ones, by providing a known email address. The main concern is confirming if our WordPress instances use this specific plugin and are exposed.

Unauthenticated users can log in as others.
Critical access risk for WordPress sites.
Confirm plugin use and exposure immediately.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by targeting the 6Storage Rentals plugin on a WordPress site. The attacker would need to know the email address of an existing user on the site. By sending a crafted request to a specific AJAX handler within the plugin, the attacker can trick the system into believing they are that user, effectively bypassing authentication. This could allow them to log in as any user, including administrators, gaining unauthorized access to the website.

No prior access required.
Triggered via a vulnerable AJAX handler.
Allows full account takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to impersonate any existing WordPress user, including administrators, by providing their email address. This means an attacker could gain full control over the website and its content.

User accounts and administrative access.
Unauthenticated users bypassing login.
Complete website compromise and data manipulation.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WordPress 6Storage Rentals plugin's authentication bypass vulnerability requires immediate attention from website administrators and the teams responsible for managing WordPress instances. The first practical step is to identify all WordPress sites utilizing this plugin, confirm their exposure to the internet, and identify the accountable owner for each instance. Subsequently, a risk-based remediation plan, potentially involving vendor coordination for a fix or temporary risk reduction measures, should be developed.

WordPress administrators own this issue.
Verify plugin usage and internet exposure.
Plan remediation based on site risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the 6Storage Rentals plugin used for?

6Storage Rentals is an add-on for WordPress websites, designed to help site owners manage storage facility inventory, rentals, and customer bookings directly through their content management system.

What does CWE-287 mean for CVE-2026-15303?

CWE-287 refers to Improper Authentication. In the context of this CVE, it means the plugin fails to verify the identity of a user attempting to log in. Because the code lacks checks to confirm who is making the request, an unauthorized person can trick the system into granting them access to any user account simply by submitting an email address.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted request to a specific AJAX handler within the plugin. Crucially, this does not require any prior access to the site or valid credentials. If the plugin is installed and active, the bug is triggered by the attacker providing the email address of an existing user; the system then erroneously creates a session for that account without further verification.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal flags this as a likely risk because the vulnerability exists in a WordPress plugin, which is typically configured to be internet-facing. Since the vulnerable AJAX handler is accessible through the public web interface, external attackers can reach it without needing to be on your internal network.

What should I do if I run 6Storage Rentals?

You should immediately audit your WordPress environment to identify if this plugin is installed. Since this vulnerability allows for complete account takeover, including administrative access, you should prioritize confirming your plugin versions. If you are using version 2.27.0 or earlier, plan for remediation by coordinating with the vendor or restricting access to the plugin until an update is applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.