What the vulnerability does
01Description
The Omnishop plugin for WordPress is vulnerable to Cross-Site Request Forgery on its /users/delete REST route in all versions up to, and including, 1.0.9. The route’s permission_callback only verifies that the requester is logged in, but fails to require any nonce or other proof of intent. This makes it possible for unauthenticated attackers to delete arbitrary user accounts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
Omnishop versions up to 1.0.9 are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in shop administrator, performs unwanted actions on the shop without their knowledge. The vulnerability requires the victim to visit the attacker's page while authenticated to the Omnishop app.
What an attacker can do
03Attacker Capabilities
Perform unauthorized actions on the shop by tricking an authenticated admin into visiting a malicious webpage.
Potential impact on your site
04Site Impact
Shop administrators could have their accounts used to modify settings, products, or orders without their consent.
Conditions required to exploit
05Prerequisites
Victim must be logged into Omnishop and visit an attacker-controlled webpage.
Key dates
06Disclosure timeline
July 23, 2025
CVE published
April 8, 2026
Record updated
