CVE-2025-6214 is a CSRF vulnerability in the Omnishop plugin for WordPress, affecting all versions up to 1.0.9. The /users/delete REST API endpoint verifies only that the requester is logged in but lacks nonce validation or other anti-CSRF protections. This flaw permits an attacker to craft a malicious request that, if executed by an authenticated administrator (e.g., by clicking a link), can delete arbitrary user accounts. The vulnerability does not require privileges beyond being logged in and does not impact confidentiality or availability but can cause integrity loss by deleting user accounts.

Successful exploitation allows an attacker to delete arbitrary user accounts on the affected WordPress site by leveraging an authenticated administrator's session. This results in integrity loss of user data but does not impact confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links while logged into the Omnishop plugin environment. Implementing additional web application firewall (WAF) rules to detect and block suspicious CSRF attempts may help mitigate risk. Monitor vendor channels for updates and apply official patches once released.