{"id":"CVE-2025-6215","aliases":["EUVD-2025-22405","GHSA-pjp4-cp6x-7mxh"],"status":"published","title":"Omnishop \u003c= 1.0.9 - Missing Registration Restriction to Unauthenticated Account Creation via /users/register REST Endpoint","description":"The Omnishop plugin for WordPress is vulnerable to Unauthenticated Registration Bypass in all versions up to, and including, 1.0.9. Its /users/register endpoint is exposed to the public (permission_callback always returns true) and invokes wp_create_user() unconditionally,  ignoring the site’s users_can_register option and any nonce or CAPTCHA checks. This makes it possible for unauthenticated attackers to create arbitrary user accounts (customer) on sites where registrations should be closed.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00301,"percentile":0.23113,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2025-07-23T02:24:37Z","modified":"2026-06-17T10:01:24Z","products":[{"vendor":"omnishop","product":"omnishop – mobile shop apps complementing your woocommerce webshop"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12d465d2-cd89-476e-b70a-743151a23053?source=cve"},{"url":"https://wordpress.org/plugins/omnishop/#developers"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6215"},{"url":"https://github.com/advisories/GHSA-pjp4-cp6x-7mxh"}],"sources":{"cve":[{"id":"CVE-2025-6215","title":"Omnishop \u003c= 1.0.9 - Missing Registration Restriction to Unauthenticated Account Creation via /users/register REST Endpoint","description":"The Omnishop plugin for WordPress is vulnerable to Unauthenticated Registration Bypass in all versions up to, and including, 1.0.9. Its /users/register endpoint is exposed to the public (permission_callback always returns true) and invokes wp_create_user() unconditionally,  ignoring the site’s users_can_register option and any nonce or CAPTCHA checks. This makes it possible for unauthenticated attackers to create arbitrary user accounts (customer) on sites where registrations should be closed.","status":"published","published":"2025-07-23T02:24:37.162Z","modified":"2026-04-08T16:36:31.597Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:32:40.774223Z"}],"euvd":[{"id":"EUVD-2025-22405","description":"The Omnishop plugin for WordPress is vulnerable to Unauthenticated Registration Bypass in all versions up to, and including, 1.0.9. Its /users/register endpoint is exposed to the public (permission_callback always returns true) and invokes wp_create_user() unconditionally,  ignoring the site’s users_can_register option and any nonce or CAPTCHA checks. This makes it possible for unauthenticated attackers to create arbitrary user accounts (customer) on sites where registrations should be closed.","status":"published","published":"2025-07-23T02:24:37Z","modified":"2026-04-08T16:36:31Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:08.748798Z"}],"ghsa":[{"id":"GHSA-pjp4-cp6x-7mxh","title":"The Omnishop plugin for WordPress is vulnerable to Unauthenticated Registration Bypass in all...","description":"The Omnishop plugin for WordPress is vulnerable to Unauthenticated Registration Bypass in all versions up to, and including, 1.0.9. Its /users/register endpoint is exposed to the public (permission_callback always returns true) and invokes wp_create_user() unconditionally,  ignoring the site’s users_can_register option and any nonce or CAPTCHA checks. This makes it possible for unauthenticated attackers to create arbitrary user accounts (customer) on sites where registrations should be closed.","status":"published","published":"2025-07-23T03:32:05Z","modified":"2025-07-23T03:32:11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:03:06.223067Z"}],"nvd":[{"id":"CVE-2025-6215","description":"The Omnishop plugin for WordPress is vulnerable to Unauthenticated Registration Bypass in all versions up to, and including, 1.0.9. Its /users/register endpoint is exposed to the public (permission_callback always returns true) and invokes wp_create_user() unconditionally,  ignoring the site’s users_can_register option and any nonce or CAPTCHA checks. This makes it possible for unauthenticated attackers to create arbitrary user accounts (customer) on sites where registrations should be closed.","status":"published","published":"2025-07-23T03:15:25.29Z","modified":"2026-06-17T10:01:24.06Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:11:19.382856Z"}]}}