CVE-2025-6214: Omnishop WordPress Plugin CSRF Vulnerability

CVE-2025-6214 Overview

CVE-2025-6214 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Omnishop plugin for WordPress in all versions up to and including 1.0.9. The flaw resides in the /users/delete REST route, where the permission_callback only verifies that the requester is logged in without validating a nonce or other proof of intent. Attackers can trick a site administrator into visiting a malicious link, causing arbitrary user accounts to be deleted. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation allows unauthenticated attackers to delete arbitrary WordPress user accounts through a forged request executed in an administrator's browser session.

Affected Products

Omnishop plugin for WordPress, all versions through 1.0.9
WordPress sites exposing the plugin's REST API endpoints
Administrator accounts targeted through social engineering vectors

Discovery Timeline

2025-07-23 - CVE-2025-6214 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6214

Vulnerability Analysis

The Omnishop plugin registers a REST API route at /users/delete that performs user deletion operations. The route's permission_callback function checks only whether the current request originates from an authenticated user. It does not verify a WordPress nonce, referrer, or any anti-CSRF token bound to the requesting session.

Because WordPress admin sessions rely on cookies, any request originating from an administrator's browser automatically carries authentication credentials. An attacker who crafts a page or link that triggers a request to the vulnerable endpoint can cause the browser to submit the deletion request on the administrator's behalf.

The attack requires user interaction, such as clicking a malicious link while logged in as an administrator. Confidentiality is unaffected, but the integrity impact is high because arbitrary user accounts can be removed without operator consent.

Root Cause

The root cause is a missing CSRF token verification in the REST route's permission_callback. WordPress provides wp_verify_nonce() and check_ajax_referer() for this purpose, but the plugin does not invoke either. Authentication is treated as sufficient authorization, violating the principle that state-changing operations require proof of intent.

Attack Vector

An attacker hosts a page containing JavaScript or an HTML form targeting the /users/delete REST route on a vulnerable WordPress site. The attacker then delivers the link through phishing, forum posts, or malicious advertising. When an authenticated administrator visits the page, the browser issues an authenticated request that deletes the specified user account.

The vulnerability manifests in the REST route registration where permission_callback returns is_user_logged_in() or an equivalent check without nonce validation. See the Wordfence Vulnerability Report for the technical breakdown.

Detection Methods for CVE-2025-6214

Indicators of Compromise

Unexpected user deletion events in the WordPress wp_users table or admin activity logs
Access log entries showing POST or DELETE requests to /wp-json/omnishop/v1/users/delete originating from external Referer headers
Administrator sessions producing REST API calls immediately after visiting third-party URLs
User complaints about missing accounts or forced re-registration

Detection Strategies

Monitor WordPress REST API access logs for requests to Omnishop endpoints with cross-origin Referer values
Enable WordPress audit logging plugins that record user deletion events and correlate them with session origins
Alert on any permission_callback invocations from routes lacking nonce headers such as X-WP-Nonce

Monitoring Recommendations

Aggregate WordPress access and application logs in a centralized SIEM for correlation of deletion events with browsing behavior
Track administrator session activity for anomalous REST API calls following external link navigation
Baseline normal user-management activity and alert on volume spikes or off-hours deletions

How to Mitigate CVE-2025-6214

Immediate Actions Required

Disable or remove the Omnishop plugin until a patched version is confirmed available
Restrict WordPress administrator accounts to dedicated browsers or sessions used only for admin tasks
Audit the user database for unexpected deletions and restore accounts from backups if needed
Train administrators to avoid clicking untrusted links while authenticated to WordPress

Patch Information

At the time of publication, the Wordfence Vulnerability Report lists all versions through 1.0.9 as affected. Administrators should consult the WordPress Plugin Documentation for the latest release and update immediately when a fixed version is published.

Workarounds

Block external access to the /wp-json/omnishop/* REST namespace at the web application firewall or reverse proxy
Enforce SameSite=Strict cookies for WordPress authentication to prevent cross-origin credential submission
Require administrators to authenticate through a separate browser profile isolated from general browsing

bash

# Example nginx rule to block external requests to the vulnerable route
location ~ ^/wp-json/omnishop/v1/users/delete {
    if ($http_referer !~* ^https://your-wordpress-site\.example/) {
        return 403;
    }
}