SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-15303 2026-08-15

CVE-2026-15303: Unauthenticated Admin Takeover in 6Storage Rentals for WordPress

"A critical authentication bypass in the 6Storage Rentals WordPress plugin (versions ≤ 2.27.0) lets any unauthenticated attacker log in as any existing user, including administrators, by submitting that user's email…"

A critical authentication bypass in the 6Storage Rentals WordPress plugin (versions ≤ 2.27.0) lets any unauthenticated attacker log in as any existing user, including administrators, by submitting that user's email address.

What Is It

CVE-2026-15303 is an authentication bypass (CWE-287) in the 6Storage Rentals plugin for WordPress, reported by Wordfence and published 2026-08-15. The plugin registers its six_storage_create_wp_user() AJAX handler on the wp_ajax_nopriv_six_storage_create_wp_user hook, the unauthenticated action namespace, without any nonce, capability, credential, or ownership verification. The handler then calls wp_set_current_user() and wp_set_auth_cookie() for whatever WordPress user resolves from the attacker-supplied email address.

The result is a direct, single-request login as an arbitrary user. No credentials, no password reset, no user interaction.

Why It Matters

Wordfence scores this CVSS 3.1 9.8 (CRITICAL): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Network-reachable, low complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability.

Administrator email addresses on WordPress sites are frequently discoverable or guessable, and the exploit primitive is a single unauthenticated AJAX POST. Successful exploitation yields a valid authenticated session cookie for an administrator account, which is functionally full site compromise: plugin/theme installation, content modification, and persistence all follow.

What's Vulnerable

Patch Status

The NVD entry for CVE-2026-15303 lists no fixed version and no patched release; the CVE is in Received status as of 2026-08-15, with a defaultStatus of unaffected only for versions outside the ≤ 2.27.0 range. CVE-2026-15303 does not appear in the CISA Known Exploited Vulnerabilities catalog; no confirmation of active exploitation and no federal remediation deadline. Absent a vendor fix, the practical mitigation is to deactivate and remove the plugin until a patched build ships.

Sources