What is the CVSS score of CVE-2026-3595?

CVE-2026-3595 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2026-3595

EUVD-2026-23182 MEDIUM

Missing Authorization (CWE-862)

2026-04-16 Wordfence

Authentication Bypass WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 16, 2026 - 06:00 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 05:45 euvd

EUVD-2026-23182

Analysis Generated

Apr 16, 2026 - 05:45 vuln.today

CVE Published

Apr 16, 2026 - 05:29 nvd

MEDIUM 5.3

DescriptionCVE.org

The Riaxe Product Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.2. This is due to the plugin registering a REST API route at POST /wp-json/InkXEProductDesignerLite/customer/delete_customer without a permission_callback, causing WordPress to default to allowing unauthenticated access, and the inkxe_delete_customer() callback function taking an array of user IDs from the request body and passing each one directly to wp_delete_user() without any authentication or authorization checks. This makes it possible for unauthenticated attackers to delete arbitrary WordPress user accounts, including administrator accounts, leading to complete site lockout and data loss.

AnalysisAI

Riaxe Product Customizer plugin for WordPress versions up to 2.1.2 allows unauthenticated attackers to delete arbitrary user accounts via a REST API endpoint lacking permission checks. The POST /wp-json/InkXEProductDesignerLite/customer/delete_customer route accepts a list of user IDs and directly deletes them without authentication or authorization validation, enabling attackers to remove administrator accounts and cause complete site lockout. This is confirmed by Wordfence and affects all installations running the vulnerable plugin version.

Technical ContextAI

The vulnerability exploits WordPress REST API registration mechanisms and the wp_delete_user() function. When a REST API route is registered without a permission_callback parameter, WordPress defaults to allowing unauthenticated access. The inkxe_delete_customer() callback function receives user IDs from the POST request body and passes them directly to wp_delete_user() without invoking any WordPress capability checks (e.g., current_user_can('delete_users')) or validating the requester's identity. This is a missing authorization control (CWE-862: Missing Authorization) in a custom REST endpoint. The affected CPE cpe:2.3:a:imprintnext:riaxe_product_customizer indicates the ImprintNext-developed Riaxe Product Customizer plugin.

RemediationAI

Update the Riaxe Product Customizer plugin to a patched version released by ImprintNext after 2.1.2. Consult the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/59da92e2-9ea0-4566-ae4d-3d5d91d0e42e for the exact fixed version number and installation instructions. As an interim compensating control if an immediate patch is unavailable, disable REST API access to the InkXEProductDesignerLite namespace by adding a rewrite rule in .htaccess to block requests to /wp-json/InkXEProductDesignerLite/customer/* - this prevents unauthenticated invocation of the vulnerable endpoint but may break frontend product customization features dependent on this API. Alternatively, restrict REST API access to authenticated users only via a WordPress security plugin (e.g., Wordfence, iThemes Security) with a rule that requires authentication for all REST endpoints not explicitly whitelisted as public. Review user access logs and audit for deletion of administrator or critical accounts; restore deleted accounts from backups if recent compromise is suspected.