Description (CNA)
The Omnishop plugin for WordPress is vulnerable to Unauthenticated Registration Bypass in all versions up to, and including, 1.0.9. Its /users/register endpoint is exposed to the public (permission_callback always returns true) and invokes wp_create_user() unconditionally, ignoring the site’s users_can_register option and any nonce or CAPTCHA checks. This makes it possible for unauthenticated attackers to create arbitrary user accounts (customer) on sites where registrations should be closed.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| omnishop / Omnishop – Mobile shop apps complementing your WooCommerce webshop | affected 0 through 1.0.9 |
CWE
CWE-862
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/12d465d2-cd89-476e-b70a-743151a23053?source=cve
- https://wordpress.org/plugins/omnishop/#developers
ADP enrichment
No English description supplied.
No references supplied.