The vulnerability in the SixStorage Rentals WordPress plugin allows attackers to bypass authorization by using the userId parameter in AJAX requests. Because the wp_ajax_nopriv_* hooks accept the tenant identifier directly from the request without verifying ownership, an unauthenticated user can retrieve or change any tenant’s personal information—including name, email, phone number, address, and Social Security Number. This flaw, classified as CWE‑639, results in a direct compromise of confidentiality, integrity, and potentially the privacy of all users under the affected tenancy.

Any WordPress site running the SixStorage Rentals plugin version 2.22.0 or earlier is at risk. The plugin must be identified via its name and version and updated or removed to mitigate the issue.

The CVSS score of 7.5 indicates high severity, and the lack of authentication checks means the attack vector is remote with minimal user interaction. While the EPSS score is unavailable, the vulnerability remains notable because it can be exploited by anyone capable of sending crafted AJAX requests to the plugin’s endpoints, allowing broad exposure of sensitive user data. The vulnerability is not yet listed in the CISA KEV catalog, but its potential impact warrants immediate attention.