PHP-SHOP 1.0 is vulnerable to a cross‑site request forgery flaw that allows an unauthenticated attacker to create new administrative users. By distributing a malicious page with a hidden form, attackers can cause an authenticated administrator to submit a POST request to users.php, supplying parameters such as name, email, password, and administrative permissions. If the form is submitted successfully, the target application adds a new account with administrator privileges, effectively granting the attacker elevated access over the system. The problem resides in the lack of request forgery protection and is classified under CWE‑352.

The affected product is PHP‑SHOP by joeyrush, version 1.0 (the master branch). Any instance running this version that exposes the users.php endpoint to authenticated administrators is susceptible to the vulnerability.

The CVSS score of 6.9 places this issue in the medium‑to‑high severity range. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker first entice a legitimate administrator to visit the malicious page; once the compromised administrator submits the hidden form, a new admin user is created. This attack path highlights the lack of CSRF tokens and proper input validation in the user‑creation flow.