The 6Storage Rentals plugin for WordPress contains a missing authorization flaw that allows attackers to exploit incorrectly configured access control security levels. Because the plugin does not enforce proper user role checks, privileged operations or restricted content could be accessed by unauthorized users. This weakness is classified as CWE‑862, which highlights vulnerabilities in authorization enforcement.

WordPress sites that use the 6Storage Rentals plugin up to and including version 2.20.2 are affected. The vulnerability applies to all installations of this plugin that rely on the default or custom access settings provided prior to the release of version 2.20.3.

The CVSS score of 5.4 indicates a moderate impact, while an EPSS score of less than 1% suggests that the likelihood of exploitation is low at present. The vulnerability is not listed in the CISA KEV catalog. Based on the nature of the flaw, the likely attack vector involves interacting with the plugin’s API or administrative interfaces, either through authenticated user accounts or via publicly reachable URLs if the site’s configuration exposes them.