Riaxe Product Customizer CVE-2026-3595

The REST API endpoint /wp-json/InkXEProductDesignerLite/customer/delete_customer must be accessible over the network (not blocked by firewall or WAF). The Riaxe Product Customizer plugin must be installed and activated on the WordPress site. No special configuration is required beyond default plugin installation - the vulnerable endpoint is registered with no permission_callback by default in the plugin code. No authentication is required because WordPress defaults to public access for endpoints without explicit permission checks. The attacker does not need to be logged in, does not need any WordPress user account, and does not require any legitimate reason to access the endpoint. The only limiting factor is that the target must be running a vulnerable version (2.1.2 or earlier) and the plugin must be active; if the plugin is deactivated or a patched version is installed, the endpoint does not exist or is protected.

The CVSS score of 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects a network-exploitable vulnerability with low attack complexity and no privileges or user interaction required. However, this score underestimates real-world impact: while CVSS Integrity impact is rated as Low (I:L) and Availability as None (A:N), the actual consequence-deletion of administrator accounts leading to site lockout and permanent data loss-constitutes both integrity compromise (account deletion) and availability degradation (site inaccessibility). The CVSS vector's Scope:Unchanged (S:U) is conservative; a successful admin account deletion effectively impacts all users of the site. No EPSS score or KEV listing provided, but the straightforward exploitation requirements (unauthenticated network access, no special conditions, no user interaction) suggest this is likely to be exploited opportunistically against any exposed WordPress installation running the plugin. This is a critical business-logic flaw that should be remediated urgently despite the moderate CVSS score.

An attacker sends a POST request to http://target-wordpress.com/wp-json/InkXEProductDesignerLite/customer/delete_customer with a JSON body containing a list of user IDs (e.g., [1, 2, 3] for the first three accounts, typically including the primary administrator). The WordPress REST API accepts the request without authentication because no permission_callback is registered. The plugin's inkxe_delete_customer() function iterates through the user IDs and calls wp_delete_user() on each, deleting them immediately. If the primary admin account is deleted, the attacker can lock out the site owner, prevent legitimate access, and cause permanent data loss of posts, media, and settings.