The vulnerability allows an unauthenticated attacker to supply an existing WordPress user’s email address to the six_storage_create_wp_user AJAX handler, which then sets the user as the current user and establishes an authentication cookie without performing any nonce, capability, or ownership checks. This results in the attacker gaining log‑in access to the target account, including administrators, thereby compromising the confidentiality, integrity, and availability of the site’s administrative functions. The weakness is a classic authentication bypass, identified as CWE‑287.

WordPress sites running the 6Storage Rentals plugin version 2.27.0 or earlier are impacted. No specific operating system or WordPress core version is listed, but any installation of the affected plugin in these versions is considered vulnerable.

The CVSS score of 9.8 signals a critical severity, and the EPSS score is not available; however, the lack of a KEV listing does not mean that exploitation is unlikely. The most likely attack vector is an unauthenticated HTTP request directed at the wp_ajax_nopriv_six_storage_create_wp_user endpoint, which is accessible to anyone on the internet. Because the handler performs no validation beyond email resolution, an attacker can gain administrative access by simply knowing a valid user’s email address.