6Storage Rentals Security & Risk Analysis

The "6storage-rentals" v2.20.2 plugin exhibits a concerning security posture, primarily due to a substantial attack surface that lacks proper authorization checks. The static analysis reveals a significant number of AJAX handlers (207) that are completely unprotected, presenting a wide avenue for potential unauthorized actions or information disclosure. While the plugin demonstrates good practices in areas like SQL query preparation (91% prepared) and output escaping (98% escaped), the lack of fundamental security controls like capability checks and nonce verification on its entry points is a major weakness. The plugin also utilizes the dangerous `unserialize` function, which can lead to critical vulnerabilities if not handled with extreme care and input validation, especially in conjunction with other identified weaknesses.

The vulnerability history further amplifies these concerns. With a total of 4 known CVEs, all of which remain unpatched, and a recent vulnerability dated in late 2025, it indicates a pattern of security oversights. The common vulnerability types of Server-Side Request Forgery (SSRF) and Missing Authorization in its history directly correlate with the static analysis findings of unprotected AJAX handlers and zero capability checks. This suggests a recurring problem with securing sensitive functionalities and preventing malicious requests.

In conclusion, while the "6storage-rentals" plugin shows some positive signs in its handling of database queries and output, these strengths are heavily outweighed by critical weaknesses in its authorization mechanisms and attack surface management. The presence of unpatched historical vulnerabilities, combined with the high number of unprotected entry points and the use of dangerous functions, creates a high-risk environment for any WordPress site using this plugin.