CVE-2026-15303 & 4 More Critical WordPress Plugin Auth Bypasses (CVSS 9.8) — Detection and Remediation Guide

NVD just published five CRITICAL-severity CVEs affecting WordPress plugins in a single three-day window: CVE-2026-15303, CVE-2026-15341, CVE-2026-15826, CVE-2026-16142, and CVE-2026-14484. Three of the five carry a CVSS base score of 9.8 (Critical) — network vector, no authentication required, no user interaction. If you run WordPress with the affected plugins, treat this as an emergency patch cycle, not a routine one.

The pattern across this cluster should worry every defender: unauthenticated AJAX handlers that let a remote attacker assume an authenticated session or create one outright. The most severe of the batch, CVE-2026-15303 in the 6Storage Rentals plugin, allows an anonymous attacker to call an exposed AJAX endpoint and have WordPress set the current user context — a textbook authentication bypass that converts directly into full administrative control of the site. WordPress powers roughly 40%+ of the web, and plugin-level auth bypasses of this class are among the most reliably mass-exploited vulnerability types we see. Expect scanning and exploitation attempts within days, if they haven't started already.

Technical Analysis

Affected Products and CVEs

Reference: NVD — CVE-2026-15303

How CVE-2026-15303 Works (6Storage Rentals ≤ 2.27.0)

This is the vulnerability your SOC should be hunting first. The root cause is a chain of missing authorization checks that we see repeatedly in WordPress plugin vulnerabilities:

1. The plugin registers an AJAX handler without an authentication gate. The handler six_storage_create_wp_user() is hooked via wp_ajax_nopriv_six_storage_create_wp_user. In WordPress, the wp_ajax_nopriv_ prefix means the action is exposed to unauthenticated, anonymous users — anyone on the internet can invoke it with a simple POST to /wp-admin/admin-ajax.php?action=six_storage_create_wp_user.
2. No nonce, capability, credential, or ownership verification. WordPress nonces (check_ajax_referer()) and capability checks (current_user_can()) are the standard defenses for AJAX handlers. None exist here. The handler blindly processes the request.
3. The handler calls wp_set_current_user() based on attacker-controlled input. This function tells WordPress to treat the current request — and potentially the established session — as belonging to the specified user account. If the attacker can specify an administrator user ID (trivially enumerable: user ID 1 is almost always the admin), the request executes in that user's security context.

The result: an unauthenticated remote attacker effectively becomes an authenticated WordPress user — up to and including administrator — without a password, without a session token, without any prior access. From admin context, the attacker can upload a malicious plugin or edit theme files to achieve remote code execution, inject web skimmers, create rogue admin accounts for persistence, and pivot into the underlying host. On shared hosting or poorly segmented infrastructure, that pivot is where the real damage begins.

The Cluster Pattern: CVE-2026-15341 and CVE-2026-15826

CVE-2026-15341 (User Session Synchronizer) and CVE-2026-15826 (User Profile Builder) follow the same broad class — authentication bypass in user/session management plugins. Plugins that touch session synchronization, user profile handling, and account creation are inherently high-risk because they sit directly in the WordPress authentication and authorization path. A flaw there doesn't just expose data; it hands over identity.

NVD's entries for CVE-2026-16142 and CVE-2026-14484 are still being fully enriched at time of writing — both are listed as CRITICAL with network attack vectors. Defenders should monitor the NVD entries and vendor channels for the affected plugin names and version ranges as enrichment completes.

Exploitation Status

• No confirmed in-the-wild exploitation or CISA KEV listing has been reported as of publication, but do not read that as safety. These CVEs are 0-3 days old.
• Unauthenticated auth-bypass flaws in WordPress plugins are historically among the fastest to be weaponized at scale — automated scanners typically begin probing admin-ajax.php endpoints within days of public disclosure. The exploit primitive here (a single unauthenticated POST) requires no sophistication whatsoever.
• Assume opportunistic mass scanning is imminent or underway. Patch first, hunt second — but do both.

Detection & Response

The good news: this vulnerability class is highly observable at the web layer. Every exploitation attempt against CVE-2026-15303 must traverse your web server as an HTTP request to admin-ajax.php containing the action name. That's a strong, low-noise detection anchor. Post-exploitation, watch for the artifacts attackers leave behind: new administrator accounts, modified theme/plugin files, and webshells in the uploads directory.

Sigma Rules

The following rules target web server access logs (Apache/Nginx) and WordPress audit telemetry. Ensure your web logs capture the full query string and POST bodies where feasible (via a WAF or ModSecurity audit log) — URI-only logging will miss POST parameter content.

---
title: WordPress AJAX Exploitation Attempt - Vulnerable Plugin Action
description: Detects HTTP requests to WordPress admin-ajax.php invoking the unauthenticated AJAX action associated with CVE-2026-15303 (6Storage Rentals) or session-manipulation actions typical of auth bypass exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-15303
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains: 'admin-ajax.php'
  selection_action:
    cs-uri-query|contains:
      - 'action=six_storage_create_wp_user'
      - 'action=user_session_sync'
  condition: selection_uri and selection_action
falsepositives:
  - Legitimate use of the 6Storage Rentals plugin frontend by site visitors (treat any hit as investigation-worthy until patched)
level: high
---
title: WordPress Suspicious Unauthenticated POST to admin-ajax.php
description: Detects POST requests to admin-ajax.php from external sources carrying plugin action parameters, a common delivery mechanism for WordPress plugin authentication bypass and RCE exploits. Tune the action list against plugins installed in your environment.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-15303
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'POST'
    cs-uri|contains: '/wp-admin/admin-ajax.php'
  filter_known_good_actions:
    cs-uri-query|contains:
      - 'action=heartbeat'
      - 'action=ajax-tag-search'
  condition: selection and not filter_known_good_actions
falsepositives:
  - Legitimate plugin AJAX functionality; baseline known-good action= values per site and alert on novel ones
level: medium
---
title: WordPress PHP File Creation in Uploads or Theme Directories
description: Detects creation of PHP files in WordPress uploads or theme directories, consistent with webshell deployment following admin-level compromise of a WordPress site via plugin auth bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-15303
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/wp-content/uploads/'
      - '/wp-content/themes/'
      - '/wp-content/plugins/'
    TargetFilename|endswith: '.php'
  filter_upload_plugins:
    TargetFilename|contains:
      - '/wp-content/uploads/sites/'
  condition: selection
falsepositives:
  - Legitimate theme/plugin updates by administrators; correlate with change windows and admin login source IPs
level: high

KQL Hunt (Microsoft Sentinel / Defender)

If your WordPress hosts send Apache/Nginx logs into Sentinel via Syslog/CEF, hunt for exploitation attempts of the vulnerable AJAX action. The second query hunts for the post-exploitation artifact: new admin account creation, which shows up as a POST to user-new.php or unexpected admin-ajax.php user-creation actions.

// Hunt 1: Exploitation attempts against CVE-2026-15303 vulnerable AJAX handler
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has "admin-ajax.php"
| where SyslogMessage has "six_storage_create_wp_user"
    or SyslogMessage has "action=user_session_sync"
| extend SourceIP = extract(@'(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})', 1, SyslogMessage)
| summarize AttemptCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, Computer
| order by AttemptCount desc
;
// Hunt 2: Rogue admin account creation following potential compromise
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("user-new.php", "admin-ajax.php")
| where RequestMethod == "POST"
| where RequestURL has_any ("createuser", "create_user", "six_storage")
| summarize count() by SourceIP, DestinationHostName, RequestURL, bin(TimeGenerated, 1h)
| order by TimeGenerated desc

Velociraptor VQL

For endpoint forensics on a potentially compromised WordPress host, hunt for recently created or modified PHP files in web content directories — the signature of webshell deployment after admin-level compromise.

-- Hunt for recently modified/created PHP files in WordPress content directories
-- Potential webshells dropped following plugin auth bypass compromise
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  '/var/www/*/wp-content/uploads/**/*.php',
  '/var/www/*/wp-content/themes/**/*.php',
  '/var/www/*/wp-content/plugins/**/*.php',
  '/var/www/html/wp-content/uploads/**/*.php'
])
WHERE Mtime > now() - 86400*7
ORDER BY Mtime DESC

Remediation and Verification Script

Run this on each WordPress host to enumerate installed plugin versions for the named plugins and flag vulnerable installs. Requires WP-CLI (standard on most managed WordPress hosts).

#!/bin/bash
# CVE-2026-15303 / WordPress plugin auth bypass cluster — verification & remediation helper
# Run as a user with WP-CLI access to the WordPress installation(s)

WP_PATH="${1:-/var/www/html}"   # pass your WordPress root as argument 1

echo "[*] Scanning $WP_PATH for vulnerable plugins..."

# Check 6Storage Rentals — vulnerable at <= 2.27.0 (CVE-2026-15303)
VER=$(wp plugin get 6storage-rentals --path="$WP_PATH" --field=version --allow-root 2>/dev/null)
if [ -n "$VER" ]; then
  echo "[!] 6Storage Rentals installed: version $VER"
  if [ "$(printf '%s\n' "2.27.0" "$VER" | sort -V | head -n1)" = "$VER" ]; then
    echo "[!!!] VULNERABLE to CVE-2026-15303 (<= 2.27.0). Updating now..."
    wp plugin update 6storage-rentals --path="$WP_PATH" --allow-root
  else
    echo "[OK] Version appears patched."
  fi
else
  echo "[OK] 6Storage Rentals not installed."
fi

# Check for the other named plugins in the cluster
for SLUG in user-session-synchronizer user-profile-builder; do
  PVER=$(wp plugin get "$SLUG" --path="$WP_PATH" --field=version --allow-root 2>/dev/null)
  if [ -n "$PVER" ]; then
    echo "[!] $SLUG installed at $PVER — force-update to latest and verify against NVD advisory"
    wp plugin update "$SLUG" --path="$WP_PATH" --allow-root
  fi
done

# Post-compromise artifact sweep: PHP files modified in uploads dir in last 7 days
echo "[*] Hunting for recently modified PHP files in uploads (possible webshells)..."
find "$WP_PATH/wp-content/uploads" -name "*.php" -mtime -7 -ls 2>/dev/null

# List administrator accounts — verify every one is expected
echo "[*] Enumerating administrator accounts (validate all are legitimate):"
wp user list --role=administrator --path="$WP_PATH" --fields=ID,user_login,user_email,user_registered --allow-root

echo "[*] Done. Review findings above before declaring the host clean."

Remediation

Priority order matters. Do these in sequence:

1. Patch 6Storage Rentals immediately. Any version ≤ 2.27.0 is vulnerable to CVE-2026-15303. Update to the latest release via the WordPress admin dashboard or WP-CLI. If an update is not yet available for your version line, deactivate and remove the plugin — there is no configuration workaround for a missing nonce/capability check in a nopriv AJAX handler.
2. Update User Session Synchronizer and User Profile Builder to the latest available versions and cross-reference the fixed version against the NVD entries for CVE-2026-15341 and CVE-2026-15826. Again: if no patched version exists yet, deactivate the plugin. An auth bypass with no patch is an unacceptable residual risk.
3. Monitor NVD enrichment for CVE-2026-16142 and CVE-2026-14484. Subscribe to NVD alerts and the Wordfence/Patchstack disclosure feeds so you catch the affected plugin names as soon as enrichment completes.
4. Deploy a WAF rule as a compensating control. Block POST requests to /wp-admin/admin-ajax.php containing action=six_storage_create_wp_user (and other actions from plugins you don't actively use) at the edge — Cloudflare, ModSecurity, or your load balancer. This buys time but is not a substitute for patching.
5. Hunt before you declare victory. Because these CVEs are trivially exploitable and disclosure is public, assume any unpatched site may have been probed. Run the detection queries above against at least 7-30 days of web logs. If you find hits against a vulnerable version, escalate to IR: enumerate admin accounts, audit recently created users, check for modified theme/plugin files and PHP in uploads, and review outbound connections from the web host.
6. Rotate credentials on any site that was exposed. If a vulnerable version was internet-facing, reset all WordPress administrator passwords and API keys, invalidate active sessions (wp session destroy --all), and review OAuth/API integrations the site held.
7. Structural hardening for the long term: enforce automatic plugin updates where your change process tolerates it, restrict admin-ajax.php to known-good action allowlists at the WAF, file-integrity monitoring on wp-content, and least-privilege database users for WordPress (no ALTER/DROP at runtime where avoidable).

The uncomfortable truth about WordPress security: the core is reasonably hardened, but the plugin ecosystem is the attack surface. An unauthenticated 9.8 in a niche rental-management plugin is exactly the kind of flaw that gets a small business's site folded into a botnet or a skimmer campaign before the owner knows the CVE exists. Patch this week, hunt this week, and put a plugin inventory and update SLA in place so the next cluster — and there will be a next one — doesn't catch you flat-footed.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub