Omnishop WordPress Plugin Unauthenticated Registration Bypass Vulnerability

A vulnerability allowing unauthenticated users to bypass registration restrictions has been identified in the Omnishop plugin for WordPress, affecting all versions through 1.0.9. The issue arises because the /users/register endpoint is publicly accessible and invokes the wp_create_user() function without any checks. This oversight ignores the site's user registration settings and bypasses nonce and CAPTCHA validations, enabling attackers to create user accounts on sites where registrations should be closed.

Impact

Exploitation of this vulnerability allows for the creation of user accounts with customer privileges, potentially leading to unauthorized access or actions within the affected WordPress site.