The 6Storage Rentals plugin for WordPress contains a server‑side request forgery flaw that permits an attacker to force the web server to send arbitrary HTTP requests to internal or external endpoints. Even though the CVSS score is 5.4, this type of vulnerability can enable data exfiltration, internal network reconnaissance, or pivoting to other services on the host. The weakness stems from insufficient input validation when the plugin builds URLs used for remote requests.

WordPress sites that have the 6Storage Rentals plugin installed at or below version 2.22.0 are affected. Any installation that has left this plugin enabled could potentially be exploited, regardless of the WordPress core version.

The CVSS score of 5.4 and an EPSS score below 1% indicate a moderate risk and a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation would require an attacker to trigger the plugin’s request‑building logic—likely through crafted requests via the normal plugin interface or the administrative dashboard—so it remains primarily a web‑based threat. Mitigation is achieved by patching or disabling the plugin; if this cannot be done, network isolation or application‑layer filtering of outbound requests may reduce the attack surface.