The Omnishop plugin for WordPress exposes an unsecured REST endpoint at /users/delete. The permission_callback performs only a generic logged‑in check, omitting the required nonce or other proof of intent. Consequently, any attacker who can force a logged‑in administrator to submit a crafted request can delete any user account without authentication. This can result in loss of user data, disruption of access control, and denial of service to functions that rely on the deleted accounts.

The vulnerability is present in all Omnishop installations up to and including version 1.0.9. The affected product is the Omnishop plugin for WordPress, which provides mobile shop apps for WooCommerce webshops.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1 % suggests exploitation is likely rare. The flaw is not listed in the CISA KEV catalog. Attackers would require a social‑engineering step to get a logged‑in administrator to trigger the REST call, making the vector web‑based and user‑dependent. The root cause is the missing CSRF protection (CWE‑352).