CVE-2026-15303 is an authentication bypass vulnerability in the 6Storage Rentals WordPress plugin versions up to and including 2.27.0. The issue stems from the six_storage_create_wp_user AJAX handler being exposed on wp_ajax_nopriv_six_storage_create_wp_user without any security checks such as nonce validation or capability verification. This handler calls wp_set_current_user() and wp_set_auth_cookie() based solely on an attacker-supplied email address, allowing unauthenticated attackers to impersonate any WordPress user, including administrators.

Successful exploitation allows an unauthenticated attacker to log in as any existing WordPress user by submitting that user's email address. This can lead to full compromise of the WordPress site, including administrative control, data theft, site defacement, or further malicious activity. The CVSS score of 9.8 reflects the critical severity and the complete loss of confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX endpoint if possible, or disable the 6Storage Rentals plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.