CVE-2026-9185: 6Storage Rentals Auth Bypass Vulnerability

CVE-2026-9185 Overview

CVE-2026-9185 is an authorization bypass vulnerability in the 6Storage Rentals plugin for WordPress affecting all versions up to and including 2.22.0. The flaw resides in the six_storage_get_user_info and six_storage_update_profile AJAX actions, which accept a tenant identifier from the userId POST parameter without ownership verification. Unauthenticated attackers can read and modify arbitrary tenant profile data by supplying enumerated user IDs in crafted requests. Exposed data includes names, email addresses, phone numbers, physical addresses, and Social Security Numbers (SSNs). The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Unauthenticated attackers can enumerate tenant IDs and exfiltrate or modify sensitive personally identifiable information (PII), including SSNs, across every tenant in affected installations.

Affected Products

6Storage Rentals plugin for WordPress, all versions up to and including 2.22.0
Confirmed vulnerable releases include 2.20.2 and 2.22.0 per source tree references
WordPress sites running the plugin with wp_ajax_nopriv_* handlers exposed

Discovery Timeline

2026-06-09 - CVE-2026-9185 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-9185

Vulnerability Analysis

The 6Storage Rentals plugin registers two AJAX handlers, six_storage_getUserInfo() and six_storage_updateProfile(), on the wp_ajax_nopriv_* hook. This hook exposes endpoints to unauthenticated visitors. Both functions read a tenant identifier directly from $_POST['userId'] and use it as a lookup key against the tenants table.

Neither handler performs session binding, ownership verification, or nonce validation against the supplied identifier. As a result, the server fulfills any request that includes a numeric userId, regardless of who is sending it. Tenant IDs are sequential and easily enumerated, which lets attackers iterate through the dataset and harvest or overwrite profile records at will.

Impact extends beyond confidentiality. Because six_storage_updateProfile() accepts arbitrary changes to identity fields, attackers can alter contact information and SSN values, corrupting business records and enabling downstream fraud or social engineering against legitimate tenants.

Root Cause

The root cause is missing access control on user-controlled identifiers, a textbook Insecure Direct Object Reference (IDOR). The handlers trust the client-supplied userId as authoritative, conflating identification with authorization. Registering the actions on wp_ajax_nopriv_* compounds the issue by removing any authentication requirement.

Attack Vector

The vulnerability is exploited remotely over the network with no authentication and no user interaction. An attacker sends a crafted POST request to wp-admin/admin-ajax.php with action=six_storage_get_user_info or action=six_storage_update_profile and an enumerated userId value. The server returns or updates that tenant's record without further checks.

No public exploit has been catalogued in ExploitDB, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Public source-code references to the vulnerable lines are available in the WordPress Plugin Trac for version 2.22.0 and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-9185

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=six_storage_get_user_info or action=six_storage_update_profile originating from unauthenticated sessions
Sequential or rapidly incrementing userId parameter values in access logs, indicating tenant enumeration
Profile update events recorded in the plugin database without a corresponding authenticated WordPress session cookie
Outbound responses containing tenant PII fields returned to IPs that have not completed any login flow

Detection Strategies

Parse web server access logs for high-volume POST traffic to admin-ajax.php referencing the two vulnerable action values within short time windows
Correlate WordPress authentication logs with AJAX activity to flag profile read or write actions executed without an authenticated session
Deploy Web Application Firewall (WAF) rules to alert on requests where userId differs from any value bound to the requester's session
Monitor database audit trails for UPDATE statements against the tenants table that lack an associated authenticated user context

Monitoring Recommendations

Centralize WordPress and reverse-proxy logs in a SIEM and build alerts for the two specific AJAX action strings
Track baseline request volumes to admin-ajax.php per source IP and flag deviations consistent with ID enumeration
Review tenant records for unexplained changes to email, phone, address, or SSN fields and reconcile against authenticated audit entries

How to Mitigate CVE-2026-9185

Immediate Actions Required

Update the 6Storage Rentals plugin to a version newer than 2.22.0 once the vendor publishes a patched release
If no fixed version is available, deactivate and remove the plugin until a patch is verified
Audit the tenants table for unauthorized profile modifications and reset affected records from backup
Notify tenants whose SSN or contact data may have been exposed, in line with applicable breach notification regulations

Patch Information

At the time of NVD publication on 2026-06-09, the advisory identifies all versions up to and including 2.22.0 as vulnerable. Site administrators should consult the Wordfence Vulnerability Report and the WordPress plugin repository for the latest fixed release and changelog confirming the addition of ownership checks and nonce validation.

Workarounds

Block unauthenticated access to admin-ajax.php requests carrying action=six_storage_get_user_info or action=six_storage_update_profile at the WAF or reverse proxy layer
Restrict access to the WordPress site behind an authentication gateway or IP allowlist while a patch is pending
Remove or rename the vulnerable handler registrations in Six_Storage_DashboardController.php if maintaining the plugin in place is unavoidable

bash

# Example nginx rule to block the vulnerable AJAX actions
location = /wp-admin/admin-ajax.php {
    if ($request_method = POST) {
        if ($request_body ~* "action=(six_storage_get_user_info|six_storage_update_profile)") {
            return 403;
        }
    }
}