Cross-Site Request Forgery in Omnishop Plugin for WordPress

CVE-2025-6214

What is CVE-2025-6214?

The Omnishop plugin for WordPress is susceptible to Cross-Site Request Forgery, which compromises the /users/delete REST route in versions up to 1.0.9. The vulnerability occurs because the permission callback only checks whether the requester is logged in, neglecting to verify a nonce or other means of confirming intent. This oversight permits unauthorized attackers to delete user accounts by tricking a site administrator into executing an action, such as clicking a link, that triggers the forged request.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References