CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-15303 — The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass...

·Source: NIST NVD

Updated:

Executive Summary

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_create_wp_user() AJAX handler being registered on wp_ajax_nopriv_six_storage_create_wp_user without any nonce, capability, credential, or ownership verification, while calling wp_set_current_user() and wp_set_auth_cookie() for any WordPress user

Analysis

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_create_wp_user() AJAX handler being registered on wp_ajax_nopriv_six_storage_create_wp_user without any nonce, capability, credential, or ownership verification, while calling wp_set_current_user() and wp_set_auth_cookie() for any WordPress user resolved by the attacker-supplied email address. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting that user's email address. CVSS Score: 9.8. Published: 2026-08-15T03:16:47.670.

Indicators of Compromise (1)

CVE (1)
CVE-2026-15303
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 15, 2026. Verified by: NIST.

Related Threats

LOWVulnerabilityNEW

Confluence adds AI-enabled automation to its product suite.

Confluence Technologies, Inc. (“Confluence”), a global leader in regulatory, analytics, and investor communications solutions for the investment management industry, today announced the launch of Confluence POINT, AI-enabled automation that optimizes workflows across its solutions.

Finextra
MEDIUMVulnerability

Would I lie to you? ANZ warns of troubling ‘scam-coaching’ trend

ANZ is warning customers about a troubling rise in 'scam‑coaching' – a tactic where criminals train victims to bypass bank security by giving them scripts, cover stories, and instructions on how to respond to bank staff.

Finextra
MEDIUMVulnerability

Korea's Jeonbuk Bank to deploy Ripple Payments for cross-border remittances

Ripple, the leading provider of blockchain-based enterprise solutions across traditional and digital finance, today announced a partnership with Jeonbuk Bank, making it the first regional bank in Korea to deploy Ripple Payments for cross-border remittances, bringing near real-time settlement to businesses that have historically relied on transfers taking days to complete.

Finextra