When triggered, the handler takes an attacker-supplied email address and uses it to resolve a corresponding WordPress user account. It then invokes 'wp_set_current_user()' and 'wp_set_auth_cookie()' to authenticate the session as that user. Because these functions are executed without validating the caller, an unauthenticated attacker can supply the email address of an administrator to gain full administrative access to the WordPress instance. This vulnerability poses a severe risk to any organization using the affected plugin version.

Impact

Successful exploitation of this vulnerability results in full administrative account takeover of the WordPress instance. An attacker can create new administrative users, install malicious plugins, modify site content, or perform site-wide configuration changes. Given the prevalence of WordPress in enterprise environments, this can lead to large-scale data exfiltration, the deployment of backdoors, or the redirection of web traffic to malicious sites.

Recommendation

• Update the 6Storage Rentals plugin to the latest available version beyond 2.27.0 immediately.
• If an update is not immediately available, disable the plugin until a patch is applied.
• Audit existing user accounts for suspicious additions or modifications occurring around the time of potential exposure.
• Review web server access logs for repeated requests to the 'admin-ajax.php' endpoint with 'action=six_storage_create_wp_user'.
• Deploy web application firewall (WAF) rules to block POST requests containing the parameter 'action=six_storage_create_wp_user' unless legitimate business needs require its use in a hardened environment.