Authorization Bypass in Riaxe Product Customizer for WordPress

CVE-2026-3595

What is CVE-2026-3595?

The Riaxe Product Customizer plugin for WordPress is susceptible to an authorization bypass due to the misconfiguration of a REST API route which inadvertently permits unauthenticated access. This vulnerability allows malicious actors to delete any user account, including those with administrative privileges, by invoking the inkxe_delete_customer() callback without an appropriate permission callback. The consequence is the potential for complete site lockout and significant data loss, as unauthorized users can manipulate critical account information without authentication.

References