PT-2026-33265 · WordPress · Riaxe Product Customizer

Kai Aizen · Published 2026-04-16 · Updated 2026-04-16 · CVE-2026-3596

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Riaxe Product Customizer versions prior to 2.1.3

Description The plugin contains a privilege escalation flaw due to an unauthenticated AJAX action ''wp ajax nopriv install-imprint'' that maps to the ink pd add option() function. This function processes the option and opt value variables from $ POST and executes delete option() and add option() using these values without nonce verification, capability checks, or an option name allowlist. Unauthenticated attackers can update arbitrary WordPress options, which may be used to enable user registration and set the default user role to administrator, leading to full site takeover.

Recommendations Update to a version later than 2.1.2.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-3596

Affected Products

Riaxe Product Customizer

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2026-3596 · Security Note
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/trunk/riaxe-product-designer.php#L5047 · Note
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/trunk/riaxe-product-designer.php#L5058 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/271a35fb-56b7-4d6b-bccc-fea1227d0913?source=cve · Note
• https://twitter.com/0dayPublishing/status/2044655708428272015 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044766420660068774 · Twitter Post
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/trunk/riaxe-product-designer.php#L183 · Note
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/trunk/riaxe-product-designer.php#L5045 · Note
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/tags/2.1.2/riaxe-product-designer.php#L5046 · Note
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/tags/2.1.2/riaxe-product-designer.php#L183 · Note
• https://twitter.com/OrizonCyber/status/2044702365832372382 · Twitter Post
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/tags/2.1.2/riaxe-product-designer.php#L5047 · Note
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/trunk/riaxe-product-designer.php#L5046 · Note
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/tags/2.1.2/riaxe-product-designer.php#L5045 · Note
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/tags/2.1.2/riaxe-product-designer.php#L5058 · Note