Beveiligingsadvies

CVE-2025-6215

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2025-07-23 02:24:37

Laatst bijgewerkt 2026-04-08 16:36:31

Toegewezen door Wordfence

CVSS-score 5.3

Status PUBLISHED

Beschrijving

The Omnishop plugin for WordPress is vulnerable to Unauthenticated Registration Bypass in all versions up to, and including, 1.0.9. Its /users/register endpoint is exposed to the public (permission_callback always returns true) and invokes wp_create_user() unconditionally, ignoring the site’s users_can_register option and any nonce or CAPTCHA checks. This makes it possible for unauthenticated attackers to create arbitrary user accounts (customer) on sites where registrations should be closed.

← Alle CVE's bekijken Bekijk op cve.org ↗