Omnishop WordPress Plugin Cross-Site Request Forgery Vulnerability Allowing Arbitrary User Deletion

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Omnishop plugin for WordPress, affecting all versions through 1.0.9. The vulnerability exists on the '/users/delete' REST route, where the permission callback only checks if the requester is logged in, without requiring a nonce or any other proof of intent. This oversight allows unauthenticated attackers to delete any user account by tricking an administrator into clicking a link that sends a forged request.

Impact

Exploitation of this vulnerability allows for the unauthorized deletion of user accounts.