EUVD-2026-23182Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Riaxe Product Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.2. This is due to the plugin registering a REST API route at POST /wp-json/InkXEProductDesignerLite/customer/delete_customer without a permission_callback, causing WordPress to default to allowing unauthenticated access, and the inkxe_delete_customer() callback function taking an array of user IDs from the request body and passing each one directly to wp_delete_user() without any authentication or authorization checks. This makes it possible for unauthenticated attackers to delete arbitrary WordPress user accounts, including administrator accounts, leading to complete site lockout and data loss.
AnalysisAI
Riaxe Product Customizer plugin for WordPress versions up to 2.1.2 allows unauthenticated attackers to delete arbitrary user accounts via a REST API endpoint lacking permission checks. The POST /wp-json/InkXEProductDesignerLite/customer/delete_customer route accepts a list of user IDs and directly deletes them without authentication or authorization validation, enabling attackers to remove administrator accounts and cause complete site lockout. This is confirmed by Wordfence and affects all installations running the vulnerable plugin version.
Technical ContextAI
The vulnerability exploits WordPress REST API registration mechanisms and the wp_delete_user() function. When a REST API route is registered without a permission_callback parameter, WordPress defaults to allowing unauthenticated access. The inkxe_delete_customer() callback function receives user IDs from the POST request body and passes them directly to wp_delete_user() without invoking any WordPress capability checks (e.g., current_user_can('delete_users')) or validating the requester's identity. This is a missing authorization control (CWE-862: Missing Authorization) in a custom REST endpoint. The affected CPE cpe:2.3:a:imprintnext:riaxe_product_customizer indicates the ImprintNext-developed Riaxe Product Customizer plugin.
RemediationAI
Update the Riaxe Product Customizer plugin to a patched version released by ImprintNext after 2.1.2. Consult the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/59da92e2-9ea0-4566-ae4d-3d5d91d0e42e for the exact fixed version number and installation instructions. As an interim compensating control if an immediate patch is unavailable, disable REST API access to the InkXEProductDesignerLite namespace by adding a rewrite rule in .htaccess to block requests to /wp-json/InkXEProductDesignerLite/customer/* - this prevents unauthenticated invocation of the vulnerable endpoint but may break frontend product customization features dependent on this API. Alternatively, restrict REST API access to authenticated users only via a WordPress security plugin (e.g., Wordfence, iThemes Security) with a rule that requires authentication for all REST endpoints not explicitly whitelisted as public. Review user access logs and audit for deletion of administrator or critical accounts; restore deleted accounts from backups if recent compromise is suspected.
More in Riaxe Product Customizer
View allUnauthenticated remote attackers can escalate to administrator privileges on WordPress sites running Riaxe Product Custo
SQL injection in Riaxe Product Customizer for WordPress (all versions ≤2.1.2) allows unauthenticated remote attackers to
Riaxe Product Customizer plugin for WordPress versions up to 2.4 exposes sensitive WooCommerce customer and order data t
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today