CVE-2025-6215: Omnishop WordPress Auth Bypass Flaw

CVE-2025-6215 Overview

CVE-2025-6215 is an unauthenticated registration bypass vulnerability in the Omnishop plugin for WordPress, affecting all versions up to and including 1.0.9. The plugin exposes a /users/register REST endpoint whose permission_callback always returns true. This endpoint invokes wp_create_user() unconditionally and ignores the site's users_can_register option, along with nonce and CAPTCHA validation. Unauthenticated attackers can create arbitrary customer accounts on sites where registration is explicitly disabled. The flaw is classified as Missing Authorization [CWE-862].

Critical Impact
Remote, unauthenticated attackers can create WordPress user accounts on affected sites even when registration is disabled, enabling account seeding for follow-on attacks.

Affected Products

Omnishop plugin for WordPress, all versions through 1.0.9
WordPress sites running Omnishop with the REST API enabled
WordPress deployments relying on users_can_register = false to block signups

Discovery Timeline

2025-07-23 - CVE-2025-6215 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6215

Vulnerability Analysis

The Omnishop plugin registers a custom REST route at /users/register to support its mobile and headless commerce features. The route's permission_callback is hardcoded to return true, meaning WordPress performs no capability or authentication check before dispatching the handler. The handler then calls wp_create_user() directly with request-supplied username, email, and password values.

Because the handler never consults the site's users_can_register option, front-end registration policy is bypassed entirely. The route also does not verify a WordPress nonce, validate a CAPTCHA response, or apply rate limiting. Attackers can script account creation against the endpoint without prior authentication.

Created accounts receive the customer role. While this role has limited privileges by default, attackers can use these accounts to abuse authenticated-only endpoints, harvest customer-area content, or serve as pivots when other role-elevation flaws are chained.

Root Cause

The root cause is missing authorization [CWE-862]. The plugin's REST controller does not gate wp_create_user() behind the site's registration policy or any authorization callback logic. A permissive permission_callback combined with unconditional user creation defeats WordPress' built-in registration controls.

Attack Vector

Exploitation requires only network access to the target site. An attacker sends an HTTP POST request to the plugin's /users/register REST endpoint with a JSON body containing the desired username, email, and password. The server processes the request without authentication, nonce, or CAPTCHA validation and returns a newly created customer account. Technical details are documented in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-6215

Indicators of Compromise

Unexpected customer role accounts created in the WordPress wp_users table without corresponding front-end registration form submissions
HTTP POST requests to /wp-json/omnishop/v1/users/register or similar Omnishop REST routes from unfamiliar IP addresses
Bursts of account creation events despite users_can_register being set to false
New user email addresses using disposable or throwaway domains

Detection Strategies

Review WordPress user tables for accounts created after the plugin was installed, filtering on the customer role
Correlate web server access logs for POST traffic to Omnishop REST routes with user_register action hooks in the WordPress audit log
Alert on any successful registration event when the site's registration setting is disabled

Monitoring Recommendations

Enable WordPress audit logging for user_register and wp_create_user events and forward logs to a centralized SIEM
Monitor REST API traffic volume to /wp-json/omnishop/* routes and baseline normal request patterns
Track failed and successful login attempts from newly created accounts to identify follow-on abuse

How to Mitigate CVE-2025-6215

Immediate Actions Required

Update the Omnishop plugin to a version later than 1.0.9 once the vendor releases a patched release
Audit the WordPress user database and remove unauthorized customer accounts created since the plugin was installed
Block public access to the Omnishop /users/register REST route at the web server or WAF layer if a patch is not yet available

Patch Information

At the time of publication, no fixed version is listed in the NVD entry. Administrators should consult the Omnishop plugin page on WordPress.org for the latest release notes and apply updates as soon as a fix is published.

Workarounds

Deactivate and remove the Omnishop plugin until a patched version is available
Add a WAF rule to deny unauthenticated POST requests to /wp-json/omnishop/v1/users/register
Enforce IP allowlisting on the WordPress REST API for administrative and integration endpoints
Require CAPTCHA and nonce validation on all registration flows via a hardening plugin

bash

# Example nginx rule to block the vulnerable endpoint until patched
location ~* /wp-json/omnishop/v1/users/register {
    deny all;
    return 403;
}