6Storage Rentals Plugin Authentication Bypass

Technical Analysis

The vulnerability resides in the six_storage_create_wp_user() function, registered on the wp_ajax_nopriv_six_storage_create_wp_user hook, meaning it is reachable by anonymous, unauthenticated requests. The handler resolves a WordPress user object from an attacker-supplied email parameter and then calls wp_set_current_user() and wp_set_auth_cookie() without verifying a nonce, capability, or any proof of ownership of that email address, effectively granting full account takeover including admin accounts. Exploitation requires only knowledge of a valid site user's email (often the admin, easily enumerable or guessed), and can be automated at scale against any site running the vulnerable plugin. Given the CVSS 9.8 rating, this is trivially weaponizable and likely to be targeted by mass-scanning botnets shortly after disclosure. If any AI agent orchestration, RAG pipeline, or automation dashboard is hosted on or integrated with a compromised WordPress instance (e.g., using WP as a CMS backend, webhook trigger source, or credential store for agent workflows), attackers gaining admin access could pivot to exfiltrate API keys, modify agent-facing content/webhooks, or inject malicious instructions into agent-consumed data sources.

Affected Systems

6Storage Rentals plugin for WordPress, versions up to and including 2.27.0; any WordPress installation with this plugin active and the AJAX nopriv endpoint reachable.

Indicators of Compromise

• AJAX action parameter: action=six_storage_create_wp_user
• Unusual POST requests to /wp-admin/admin-ajax.php containing six_storage_create_wp_user
• Unexpected admin logins correlating with known user emails and no corresponding legitimate login event
• Anomalous wp_set_auth_cookie session creation without prior credential submission

Remediation Steps

1. 1

   Update the plugin

   Upgrade 6Storage Rentals to the patched version beyond 2.27.0 as soon as it is released by the vendor.

2. 2

   Disable or remove the plugin

   If no patch is yet available, deactivate and remove the 6Storage Rentals plugin until a fix is confirmed.

3. 3

   Monitor AJAX endpoint traffic

   Inspect web server and WAF logs for requests to admin-ajax.php with action=six_storage_create_wp_user and block/rate-limit suspicious sources.

4. 4

   Force password resets and session invalidation

   Invalidate all active sessions and force password resets for all WordPress users, especially administrators, to eliminate any hijacked sessions.

5. 5

   Audit user accounts and site content

   Review admin user lists, plugin/theme files, and scheduled tasks for unauthorized changes indicating post-exploitation activity.

6. 6

   Rotate exposed credentials

   If the affected WordPress site is integrated with API keys, webhooks, or automation/agent tooling, rotate all associated credentials and secrets as a precaution.