PT-2026-31096 · WordPress · Riaxe Product Customizer

Kai Aizen

·

Published

2026-04-08

·

Updated

2026-04-13

·

CVE-2026-3594

CVSS v3.1

5.3

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Riaxe Product Customizer plugin for WordPress versions up to and including 2.4
Description The Riaxe Product Customizer plugin for WordPress is susceptible to exposure of sensitive information. The '/wp-json/InkXEProductDesignerLite/orders' API endpoint lacks authentication or authorization checks due to its 'permission callback' being set to ' return true'. This allows unauthenticated attackers to retrieve customer first and last names, customer IDs, order IDs, order totals, order dates, currencies, and order statuses directly from the database.
Recommendations Update the Riaxe Product Customizer plugin to a version later than 2.4.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-3594

Affected Products

Riaxe Product Customizer