IT SBIT Services
Schneeberger
DEEN
CVE tracker

6Storage Rentals: Authentication bypass leading to administrator account takeover

CVE-2026-103883High 8.8

← All vulnerabilities

Summary

The 6Storage Rentals WordPress plugin up to and including version 2.31.0 contains an authentication bypass. An attacker with a Subscriber-level account can overwrite a site-wide plugin option and then log in as any existing WordPress user, including administrators whose email address is known or guessable. This can lead to full site compromise. The issue is described as an incomplete fix of an earlier flaw in the same plugin.

Affected

  • sixstorage 6Storage Rentals, all versions up to and including 2.31.0
  • Default configuration: unaffected (per CVE record)

Fixed in

Unknown. No vendor-confirmed fixed version was found. Check the plugin changelog for versions above 2.31.0 and do not assume 2.29.0 or later is safe.

Workaround

  • Deactivate and remove the plugin until a verified patched version is available.
  • If the plugin must stay active, disable open user registration or restrict new accounts to a minimal role.
  • Audit administrator accounts and recent admin logins, reset admin passwords and end active sessions.
  • Check for unexpected changes to plugin options.
  • Restrict or monitor access to admin-ajax.php where possible.

Exploitation

  • Not known to be exploited in the wild as of 11 Nov 2026 (OffSeq tracker).
  • No public proof-of-concept found in the indexes checked by the tracker. This is not a complete search.

Our recommendation

  • Check whether the plugin is installed on any WordPress site, including sites you do not actively maintain.
  • Remove the plugin or isolate the site until the vendor releases a verified fix.
  • Review administrator accounts and sessions for unexpected entries.
  • Monitor logs for admin-ajax.php requests from unknown accounts and for new administrator logins.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:24.

Original description (NVD)

The 6Storage Rentals plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 2.31.0. The vulnerability exists because the `six_storage_portal_registration()` AJAX handler — registered on `wp_ajax_six_storage_portal_plugin_registration` — performs no capability check and no nonce verification before writing the caller-supplied `six_storage_online_api_url` POST parameter to the site-wide option of the same name; the unauthenticated `six_storage_create_wp_user()` handler then redeems a transient seeded from that attacker-controlled URL's response and unconditionally calls `wp_set_current_user()` and `wp_set_auth_cookie()` with no ownership or credential verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to authenticate as any existing WordPress user — including any administrator whose email address is known or guessable — resulting in full site compromise. This issue represents an incomplete fix for a prior vulnerability: the 2.29.0 remediation moved the target email out of POST data into a server-side transient, but because any Subscriber can still overwrite the outbound API URL that populates that transient, the full authentication bypass chain remains exploitable in three AJAX requests.

NVD references (6)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed