Junglewise Threat Intelligence

CVE-2026-3594: Riaxe Product Customizer sensitive information exposure in REST API

CVE-2026-3594 · Severity: medium · CVSS 5.3 · Published 2026-04-08

Executive brief

The Riaxe Product Customizer plugin for WordPress, which allows customers to design custom products, contains a security flaw that exposes sensitive order information. An unauthorized person can access details such as customer names, order totals, and purchase history without needing a password. This could lead to the exposure of private customer data and business transaction history from the online store.

Technical details

The Riaxe Product Customizer plugin for WordPress is vulnerable to sensitive information exposure due to an insecurely configured REST API endpoint, '/wp-json/InkXEProductDesignerLite/orders'. The endpoint is registered with the 'permission_callback' parameter set to '__return_true', which bypasses all authentication and authorization checks. An unauthenticated attacker can send a network request to this endpoint to retrieve WooCommerce order data directly from the database. Exposed information includes customer first and last names, customer IDs, order IDs, order totals, dates, currencies, and order statuses. All versions up to and including 2.4 are affected.

Affected products

  • imprintnext Riaxe Product Customizer up to, and including, 2.4

Timeline

  • 2026-04-08: disclosed: Initial disclosure date
  • 2026-04-08: advisory: Wordfence published the vulnerability details

References