sixstorage 6Storage Rentals Plugin up to 2.22.0 on WordPress Request six_storage_getUserInfo userId authorization

Summaryinfo

A vulnerability was found in sixstorage 6Storage Rentals Plugin up to 2.22.0 on WordPress. It has been rated as problematic. This issue affects the function six_storage_getUserInfo of the component Request Handler. This manipulation of the argument userId causes authorization. The identification of this vulnerability is CVE-2026-9185. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in sixstorage 6Storage Rentals Plugin up to 2.22.0 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function six_storage_getUserInfo of the component Request Handler. The manipulation of the argument userId with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. As an impact it is known to affect confidentiality. The summary by CVE is:

The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.22.0 via the `userId` parameter of the `six_storage_get_user_info` and `six_storage_update_profile` AJAX actions. This is due to the `six_storage_getUserInfo()` and `six_storage_updateProfile()` functions being registered on `wp_ajax_nopriv_*` hooks and accepting a tenant identifier directly from `$_POST['userId']` without performing any ownership verification, session binding, or nonce validation to confirm the requester has a legitimate relationship to the supplied ID. This makes it possible for unauthenticated attackers to read and modify arbitrary tenants' profile data — including name, email address, phone number, physical address, and SSN — by supplying an enumerated `userId` value in a crafted request to either handler.

The weakness was shared by Joy Gilbert. It is possible to read the advisory at wordfence.com. This vulnerability is known as CVE-2026-9185 since 05/21/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 2.20.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-35307). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• sixstorage

Name

• 6Storage Rentals Plugin

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion