CVE-2026-9185 affects the 6Storage Rentals plugin for WordPress in versions prior to 2.22.1. The vulnerability is an authorization bypass through a user-controlled key (userId) in the AJAX actions six_storage_get_user_info and six_storage_update_profile. These actions are registered on wp_ajax_nopriv_* hooks, allowing unauthenticated access. The functions six_storage_getUserInfo() and six_storage_updateProfile() accept the userId parameter directly from POST data without verifying ownership, session binding, or nonce validation. This enables attackers to enumerate user IDs and read or modify sensitive tenant profile data, including personally identifiable information such as SSN. No official patch or remediation level is indicated in the vendor or CVE data.

An unauthenticated attacker can bypass authorization controls to access and modify sensitive tenant profile information, including names, email addresses, phone numbers, physical addresses, and social security numbers. This compromises confidentiality and integrity of user data but does not affect availability. The vulnerability poses a significant privacy risk and potential for identity theft or fraud.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX endpoints if possible, and monitor for suspicious activity related to these endpoints. Avoid exposing the plugin on publicly accessible sites without additional access controls. Implementing custom code to validate user ownership and session binding before processing userId parameters may mitigate risk temporarily.