Cross-Site Request Forgery in Omnishop Plugin for WordPress

CVE-2025-6214

What is CVE-2025-6214?

The Omnishop plugin for WordPress is susceptible to Cross-Site Request Forgery, which compromises the /users/delete REST route in versions up to 1.0.9. The vulnerability occurs because the permission callback only checks whether the requester is logged in, neglecting to verify a nonce or other means of confirming intent. This oversight permits unauthorized attackers to delete user accounts by tricking a site administrator into executing an action, such as clicking a link, that triggers the forged request.

References