https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T21:17:06.310038+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-281954 EUVD-2026-281954 2026-10-15T21:17:06.312362+00:00 EUVD-2026-281954 https://cve.radiocsirt.org/vuln/fkie_cve-2025-6215 fkie_cve-2025-6215 2026-10-15T21:17:06.312414+00:00

The Omnishop plugin for WordPress is vulnerable to Unauthenticated Registration Bypass in all versions up to, and including, 1.0.9. Its /users/register endpoint is exposed to the public (permission_callback always returns true) and invokes wp_create_user() unconditionally, ignoring the site’s users_can_register option and any nonce or CAPTCHA checks. This makes it possible for unauthenticated attackers to create arbitrary user accounts (customer) on sites where registrations should be closed.

 https://cve.radiocsirt.org/vuln/ghsa-pjp4-cp6x-7mxh GHSA-pjp4-cp6x-7mxh 2026-10-15T21:17:06.312454+00:00

The Omnishop plugin for WordPress is vulnerable to Unauthenticated Registration Bypass in all versions up to, and including, 1.0.9. Its /users/register endpoint is exposed to the public (permission_callback always returns true) and invokes wp_create_user() unconditionally, ignoring the site’s users_can_register option and any nonce or CAPTCHA checks. This makes it possible for unauthenticated attackers to create arbitrary user accounts (customer) on sites where registrations should be closed.