CVE-2026-15303: WordPress 6Storage Rentals Authentication Bypass

Executive Summary

A critical authentication bypass vulnerability has been disclosed in the 6Storage Rentals WordPress plugin. Tracked as CVE-2026-15303 with a CVSS score of 9.8 (Critical), the flaw affects all versions up to and including 2.27.0. It allows unauthenticated attackers to create WordPress user accounts — potentially with elevated roles — by abusing an unprotected AJAX handler.

Vulnerability Overview

Technical Details

The vulnerability exists in the six_storage_create_wp_user() AJAX handler within the 6Storage Rentals plugin. This handler is registered on wp_ajax_nopriv_six_storage_create_wp_user, which exposes it to unauthenticated users. Critically, the handler performs no nonce validation, no capability checks, no credential verification, and no ownership check before creating a WordPress user account.

This means any anonymous HTTP request to the WordPress admin-ajax endpoint with the corresponding action can trigger the account creation logic, effectively bypassing WordPress's authentication layer entirely.

Attack Flow

1. Attacker identifies a WordPress site running 6Storage Rentals <= 2.27.0
2. Sends a crafted POST request to wp-admin/admin-ajax.php
   with action=six_storage_create_wp_user and desired user details
3. Plugin creates a new WordPress user without any authentication check
4. Attacker logs in with the newly created account
5. Depending on role assigned, attacker may gain editor, author, or admin access

Impact

• Unauthenticated account creation: Any attacker can register WordPress accounts without restriction.
• Potential privilege escalation: Depending on the default role assigned during account creation, attackers may gain elevated access to the WordPress administration interface.
• Site compromise: Admin-level access allows installation of malicious plugins, backdoors, or full content takeover.
• Mass exploitation risk: The trivial exploit path (a single HTTP request) makes this highly attractive for automated scanning and exploitation.

Affected Versions

Remediation

1. Update immediately: Install the latest patched version of 6Storage Rentals from the WordPress plugin repository.
2. Audit existing users: Review wp_users for any accounts created by unknown parties, particularly those created recently.
3. Remove unauthorized accounts: Delete any suspicious user accounts found during the audit.
4. If patching is not immediately possible: Deactivate the plugin until an update can be applied.
5. Review logs: Check web server access logs for POST requests to admin-ajax.php with action=six_storage_create_wp_user.

Detection

Monitor for unexpected POST requests to wp-admin/admin-ajax.php with action=six_storage_create_wp_user originating from unknown IP addresses. Unexpected new user registrations in the WordPress admin panel (Users menu) should also be investigated, particularly those with roles beyond the default subscriber level.

References

• NVD — CVE-2026-15303
• WordPress Plugin Repository — 6Storage Rentals