CVE-2025-6215 is a Missing Authorization vulnerability (CWE-862) in the Omnishop plugin for WordPress, affecting all versions up to 1.0.9. The plugin's /users/register endpoint publicly exposes user registration functionality without proper permission checks, as the permission_callback always returns true. It calls wp_create_user() unconditionally, bypassing the users_can_register option and any nonce or CAPTCHA verification. This flaw enables unauthenticated attackers to create arbitrary customer accounts on affected sites.

The vulnerability allows attackers to bypass intended registration restrictions and create unauthorized user accounts. While it does not directly disclose sensitive data or allow privilege escalation, it can lead to unauthorized access as a customer-level user, potentially facilitating further abuse or fraud on the affected WooCommerce webshop.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling or restricting access to the /users/register endpoint or implementing custom authorization checks to prevent unauthorized registrations.