Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 42,685 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · 6storage-rentals
6Storage Rentals
6 known vulnerabilities on record. Add your version above to see which ones affect you.
Aug 14, 20266Storage Rentals: Authentication bypassCVE-2026-15303 · affects up to 2.27.0 · reported by WordfenceCritical 9.8
The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_create_wp_user() AJAX handler being registered on wp_ajax_nopriv_six_storage_create_wp_user without any nonce, capability, credential, or ownership verification, while calling wp_set_current_user() and wp_set_auth_cookie() for any WordPress user resolved by the attacker-supplied email address. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting that user's email address.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 20266Storage Rentals: Authorization Bypass Through User-Controlled KeyCVE-2026-9185 · affects up to 2.22.0 · reported by WordfenceHigh 7.5
The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.22.0 via the `userId` parameter of the `six_storage_get_user_info` and `six_storage_update_profile` AJAX actions. This is due to the `six_storage_getUserInfo()` and `six_storage_updateProfile()` functions being registered on `wp_ajax_nopriv_*` hooks and accepting a tenant identifier directly from `$_POST['userId']` without performing any ownership verification, session binding, or nonce validation to confirm the requester has a legitimate relationship to the supplied ID. This makes it possible for unauthenticated attackers to read and modify arbitrary tenants' profile data — including name, email address, phone number, physical address, and SSN — by supplying an enumerated `userId` value in a crafted request to either handler.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 24, 20256Storage Rentals: Server-Side Request Forgery (SSRF)CVE-2025-67623 · affects up to 2.22.0 · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Server Side Request Forgery.This issue affects 6Storage Rentals: from n/a through <= 2.22.0.
Jun 6, 20256Storage Rentals: Missing AuthorizationCVE-2023-26002 · affects up to 2.19.5 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in 6Storage 6Storage Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects 6Storage Rentals: from n/a through 2.19.5.
May 23, 20256Storage Rentals: Missing AuthorizationCVE-2025-47619 · affects up to 2.20.2 · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Path Traversal.This issue affects 6Storage Rentals: from n/a through <= 2.20.2.
Apr 4, 20256Storage Rentals: Missing AuthorizationCVE-2025-32178 · affects up to 2.20.2 · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 6Storage Rentals: from n/a through <= 2.20.2.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.