CVE-2026-9185 is an authorization bypass vulnerability in the 6Storage Rentals WordPress plugin affecting all versions up to 2.22.0. The vulnerability arises because the six_storage_getUserInfo() and six_storage_updateProfile() functions are exposed via wp_ajax_nopriv_* hooks and accept a userId parameter from POST requests without verifying the requester's authorization or session binding. This allows unauthenticated attackers to enumerate user IDs and access or modify sensitive tenant profile data such as name, email, phone number, physical address, and social security number.

An attacker can exploit this vulnerability remotely without authentication to access and alter sensitive personal information of any tenant in the system. This compromises confidentiality and integrity of user data but does not affect availability. The CVSS 3.1 base score is 7.5 (High), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX endpoints or disable the 6Storage Rentals plugin if possible. Monitor for updates from the vendor and apply official patches promptly once released.