6Storage Rentals (<= 2.31.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/6storage-rentals--2.31.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 13:55:21 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svg6Storage Rentals: Authentication bypass and account takeover (CVE-2026-103883)https://feed.craftedsignal.io/briefs/2026-11-01-cve-2026-103883/Wed, 11 Nov 2026 13:55:21 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-01-cve-2026-103883/The 6Storage Rentals WordPress plugin contains an authentication bypass vulnerability that allows authenticated attackers with Subscriber-level access or higher to authenticate as any existing WordPress user, including administrators.The 6Storage Rentals plugin for WordPress (versions up to and including 2.31.0) is vulnerable to Authentication Bypass leading to Administrator Account Takeover. The six_storage_portal_registration() AJAX handler fails to perform capability checks or nonce verification when writing the six_storage_online_api_url POST parameter to site-wide options. Subsequently, the six_storage_create_wp_user() handler redeems a transient seeded from the attacker-controlled URL and calls wp_set_current_user() and wp_set_auth_cookie() without credential verification. This allows authenticated attackers with Subscriber-level access or higher to authenticate as any WordPress user.

]]>highadvisory