What is the CVSS score of CVE-2026-3594?

CVE-2026-3594 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2026-3594

EUVD-2026-20105 MEDIUM

Information Exposure (CWE-200)

2026-04-08 Wordfence

GHSA-w5hq-hr8w-m998

WordPress Information Disclosure

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 07:00 euvd

EUVD-2026-20105

Analysis Generated

Apr 08, 2026 - 07:00 vuln.today

CVE Published

Apr 08, 2026 - 06:43 nvd

MEDIUM 5.3

DescriptionCVE.org

The Riaxe Product Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4 via the '/wp-json/InkXEProductDesignerLite/orders' REST API endpoint. The endpoint is registered with 'permission_callback' set to '__return_true', meaning no authentication or authorization checks are performed. The endpoint queries WooCommerce order data from the database and returns it to the requester, including customer first and last names, customer IDs, order IDs, order totals, order dates, currencies, and order statuses. This makes it possible for unauthenticated attackers to extract sensitive customer and order information from the WooCommerce store.

AnalysisAI

Riaxe Product Customizer plugin for WordPress versions up to 2.4 exposes sensitive WooCommerce customer and order data through an unauthenticated REST API endpoint due to a missing permission callback. Attackers can query the '/wp-json/InkXEProductDesignerLite/orders' endpoint to retrieve customer names, order IDs, totals, dates, and statuses without authentication. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The vulnerability exists in the Riaxe Product Customizer plugin's REST API endpoint registration, which implements CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The endpoint is registered with 'permission_callback' set to '__return_true', a PHP function that unconditionally returns true, bypassing WordPress's standard authentication and authorization mechanisms. When accessed via '/wp-json/InkXEProductDesignerLite/orders', the endpoint queries WooCommerce order tables directly and serializes sensitive customer and transactional data in JSON format. The CPE identifier (cpe:2.3:a:imprintnext:riaxe_product_customizer:*:*:*:*:*:*:*:*) indicates all versions of the plugin are affected. This is a classic information disclosure flaw where a REST endpoint intended for internal or authenticated use is inadvertently exposed to unauthenticated clients via WordPress's REST API infrastructure.

RemediationAI

Update the Riaxe Product Customizer plugin to a patched version released after 2.4. Site administrators should navigate to the WordPress dashboard, go to Plugins, and update the plugin to the latest available version provided by ImprintNext. If no patched version is available at time of update, immediately disable the plugin until a fix is released. As an interim mitigation, site administrators can use a Web Application Firewall (WAF) or .htaccess rules to block access to the '/wp-json/InkXEProductDesignerLite/orders' endpoint, though this requires manual configuration and does not address the underlying code defect. Monitor the Wordfence threat intelligence feed and WordPress plugin repository for patch announcements from ImprintNext.