WordPress 6Storage Rentals plugin <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter vulnerability

Unauthenticated Account Takeover via 'email' Parameter vulnerability discovered by WordFence in WordPress Plugin 6Storage Rentals versions = 2.27.0...

CVE-2026-15303

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the sixstoragecreatewpuser AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownership...

CVE-2026-15303 6Storage Rentals <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the sixstoragecreatewpuser AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownership...

CVE-2026-15303

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the sixstoragecreatewpuser AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownership...

CVE-2026-15303

The CVE pertains to the 6Storage Rentals WordPress plugin (affected versions up to 2.27.0). The vulnerability is an authentication bypass in the six_storage_create_wp_user() AJAX handler, registered on wp_ajax_nopriv_six_storage_create_wp_user without nonce, capability, credential, or ownership v...

EUVD-2026-58840

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the sixstoragecreatewpuser AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownership...

PT-2026-72144

Name of the Vulnerable Software and Affected Versions 6Storage Rentals versions prior to 2.27.1 Description An authentication bypass exists that allows unauthenticated attackers to log in as any existing WordPress user, including administrators. The issue occurs because the six storage create wp...

6Storage Rentals < 2.29.0 - Unauthenticated Account Takeover via 'email' Parameter

Description The plugin is vulnerable to authentication bypass. This is due to the sixstoragecreatewpuser AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownership verification, while calling wpsetcurrentuser and wpsetauthcookie for...

EUVD-2023-29889

Malicious code in bioql PyPI...

EUVD-2025-9836

Malicious code in bioql PyPI...

6Storage Rentals <= 2.19.6 - Missing Authorization

Description The 6Storage Rentals plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.19.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an...

CVE-2023-26002

Missing Authorization vulnerability in 6Storage 6Storage Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects 6Storage Rentals: from n/a through 2.19.5...

CVE-2023-26002

Missing Authorization vulnerability in 6Storage 6Storage Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects 6Storage Rentals: from n/a through 2.19.5...

CVE-2023-26002 WordPress 6Storage Rentals <= 2.19.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in 6Storage 6Storage Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects 6Storage Rentals: from n/a through 2.19.5...

CVE-2023-26002 WordPress 6Storage Rentals plugin <= 2.22.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 6Storage Rentals: from n/a through = 2.22.0...

CVE-2023-26002

CVE-2023-26002 is a Missing Authorization vulnerability in the WordPress plugin 6Storage Rentals. Affected: 6Storage Rentals (WordPress), with exposure up to 2.19.5 (per CVE); Wordfence also references ≤ 2.19.6. Root cause: misconfigured access control security levels leading to authorization byp...

CVE-2025-47619

Missing Authorization vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Path Traversal.This issue affects 6Storage Rentals: from n/a through = 2.22.0...

CVE-2025-47619

Missing Authorization vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Path Traversal.This issue affects 6Storage Rentals: from n/a through = 2.20.2...

CVE-2025-47619 WordPress 6Storage Rentals plugin <= 2.20.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Path Traversal.This issue affects 6Storage Rentals: from n/a through = 2.20.2...

CVE-2025-47619

CVE-2025-47619 affects WordPress plugin 6Storage Rentals (vulnerable until 2.19.4; patch available in later releases, e.g., 2.20.0). The issue is a Missing Authorization vulnerability that enables Path Traversal, allowing an unauthenticated or limited-auth user to access restricted files via path...