CVE-2025-6214

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6214", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-17T21:08:02.919Z", "datePublished": "2025-07-23T02:24:39.397Z", "dateUpdated": "2026-04-08T17:30:26.839Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:30:26.839Z"}, "affected": [{"vendor": "omnishop", "product": "Omnishop \u2013 Mobile shop apps complementing your WooCommerce webshop", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Omnishop plugin for WordPress is vulnerable to Cross-Site Request Forgery on its /users/delete REST route in all versions up to, and including, 1.0.9. The route\u2019s permission_callback only verifies that the requester is logged in, but fails to require any nonce or other proof of intent. This makes it possible for unauthenticated attackers to delete arbitrary user accounts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Omnishop <= 1.0.9 - Cross-Site Request Forgery to Arbitrary User Deletion via /users/delete REST Endpoint", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e7c936b8-3132-45e1-92ed-32ecdc9cbb1e?source=cve"}, {"url": "https://wordpress.org/plugins/omnishop/#developers"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "ch4r0n"}], "timeline": [{"time": "2025-07-22T14:02:42.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-23T18:26:05.483773Z", "id": "CVE-2025-6214", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-23T18:28:29.460Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6214", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-23T18:26:05.483773Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-23T18:27:12.057Z"}}], "cna": {"title": "Omnishop <= 1.0.9 - Cross-Site Request Forgery to Arbitrary User Deletion via /users/delete REST Endpoint", "credits": [{"lang": "en", "type": "finder", "value": "ch4r0n"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"}}], "affected": [{"vendor": "omnishop", "product": "Omnishop \u2013 Mobile shop apps complementing your WooCommerce webshop", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-22T14:02:42.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e7c936b8-3132-45e1-92ed-32ecdc9cbb1e?source=cve"}, {"url": "https://wordpress.org/plugins/omnishop/#developers"}], "descriptions": [{"lang": "en", "value": "The Omnishop plugin for WordPress is vulnerable to Cross-Site Request Forgery on its /users/delete REST route in all versions up to, and including, 1.0.9. The route\u2019s permission_callback only verifies that the requester is logged in, but fails to require any nonce or other proof of intent. This makes it possible for unauthenticated attackers to delete arbitrary user accounts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:30:26.839Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6214", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:30:26.839Z", "dateReserved": "2025-06-17T21:08:02.919Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-23T02:24:39.397Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Omnishop \u2013 Mobile shop apps complementing your WooCommerce webshop", "vendor": "omnishop", "versions": [{"lessThanOrEqual": "1.0.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Omnishop plugin for WordPress is vulnerable to Cross-Site Request Forgery on its /users/delete REST route in all versions up to, and including, 1.0.9. The route\u2019s permission_callback only verifies that the requester is logged in, but fails to require any nonce or other proof of intent. This makes it possible for unauthenticated attackers to delete arbitrary user accounts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento Omnishop para WordPress es vulnerable a Cross-Site Request Forgery en su ruta REST /users/delete en todas las versiones hasta la 1.0.9 incluida. El permiso_callback de la ruta solo verifica que el solicitante haya iniciado sesi\u00f3n, pero no requiere ning\u00fan nonce ni ninguna otra prueba de intenci\u00f3n. Esto permite a atacantes no autenticados eliminar cuentas de usuario arbitrarias mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-6214", "lastModified": "2026-06-17T10:01:23.960", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6214", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-23T18:26:05.483773Z", "version": "2.0.3"}}]}, "published": "2025-07-23T03:15:25.130", "references": [{"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/omnishop/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e7c936b8-3132-45e1-92ed-32ecdc9cbb1e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T22:09:01.789179+00:00", "value": {"mitigation_remediation": ["Upgrade Omnishop to a version newer than 1.0.9 to receive the vendor\u2011supplied CSRF guard for the /users/delete route.", "If an immediate update is infeasible, block or disable the /users/delete REST route through a web\u2011application firewall rule or by removing the endpoint with a plugin filter, ensuring that only requests including a valid WordPress nonce are accepted.", "Implement monitoring or audit logging for user deletion actions to detect anomalous activity and trigger alerts when an unexpected account removal occurs."], "summary": {"action": "Apply patch", "impact": "Arbitrary user deletion via CSRF"}, "threat_synthesis": {"affected_systems": "The vulnerability is present in all Omnishop installations up to and including version 1.0.9. The affected product is the Omnishop plugin for WordPress, which provides mobile shop apps for WooCommerce webshops.", "description_and_impact": "The Omnishop plugin for WordPress exposes an unsecured REST endpoint at /users/delete. The permission_callback performs only a generic logged\u2011in check, omitting the required nonce or other proof of intent. Consequently, any attacker who can force a logged\u2011in administrator to submit a crafted request can delete any user account without authentication. This can result in loss of user data, disruption of access control, and denial of service to functions that rely on the deleted accounts.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1\u202f% suggests exploitation is likely rare. The flaw is not listed in the CISA KEV catalog. Attackers would require a social\u2011engineering step to get a logged\u2011in administrator to trigger the REST call, making the vector web\u2011based and user\u2011dependent. The root cause is the missing CSRF protection (CWE\u2011352)."}}}}, "created": "2025-07-23T17:35:55.886180+00:00", "updated": "2026-04-20T22:15:06.194675+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}