The Omnishop plugin contains an unauthenticated registration bypass that allows attackers to create arbitrary WordPress user accounts via the /users/register endpoint. The API call ignores both the site’s registration setting and any security mechanisms such as nonces or CAPTCHAs, meaning anyone can register new members without authentication. This flaw enables attackers to populate the site with spam accounts, potentially facilitating credential stuffing, targeted phishing, or lockout attacks. While the vulnerability does not provide direct code execution or data exfiltration, the ability to create unlimited accounts can be weaponized for denial‑of‑service or as a foothold for further attacks.

The flaw affects all Omnishop plugin versions up to and including 1.0.9 installed on WordPress sites. No newer versions are listed in the data, so any site running Omnishop 1.0.9 or earlier is vulnerable.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1 percent suggests a very low probability of exploitation in the wild. The plugin’s registration endpoint is publicly accessible and the error conditions are trivial to trigger, so the attack vector is unauthenticated, remote, and requires no privileged access. The vulnerability is not listed in CISA’s KEV catalogue, indicating it has not been reported as a widely exploited target.