What the vulnerability does
01Description
The Omnishop plugin for WordPress is vulnerable to Unauthenticated Registration Bypass in all versions up to, and including, 1.0.9. Its /users/register endpoint is exposed to the public (permission_callback always returns true) and invokes wp_create_user() unconditionally, ignoring the site’s users_can_register option and any nonce or CAPTCHA checks. This makes it possible for unauthenticated attackers to create arbitrary user accounts (customer) on sites where registrations should be closed.
Explanation of Vulnerability in Simple Terms
02Summary
Omnishop versions up to 1.0.9 lack proper authorization checks, allowing unauthenticated attackers to modify data through the mobile app API. No authentication is required to exploit this vulnerability. The flaw affects the integrity of shop data but does not expose sensitive information or cause service disruption.
What an attacker can do
03Attacker Capabilities
Modify shop data without authentication via the mobile app API.
Potential impact on your site
04Site Impact
Attackers can alter WooCommerce shop data (products, orders, settings) without logging in.
Conditions required to exploit
05Prerequisites
Network access to the Omnishop API; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 23, 2025
CVE published
April 8, 2026
Record updated
