Sensitive Information Exposure in Riaxe Product Customizer Plugin for WordPress

CVE-2026-3594

What is CVE-2026-3594?

The Riaxe Product Customizer plugin for WordPress contains a vulnerability that allows unauthenticated attackers to access sensitive user data through an insecure REST API endpoint. This vulnerability affects all versions up to and including 2.4. The '/wp-json/InkXEProductDesignerLite/orders' endpoint is improperly configured with a permission callback that allows unrestricted access, leading to the exposure of sensitive customer information such as names, IDs, order totals, and statuses. Website owners utilizing this plugin should take immediate action to secure their systems.

References