What is the CVSS score of CVE-2026-3596?

CVE-2026-3596 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3596?

The Riaxe Product Customizer plugin (versions ≤2.1.2) contains a critical vulnerability allowing unauthenticated attackers to gain full administrator access to WordPress sites by manipulating core…

How to fix or mitigate CVE-2026-3596?

Within 24 hours: Audit all WordPress installations for Riaxe Product Customizer plugin presence and version; immediately deactivate and remove any instance running version 2.1.2 or earlier. Within 7 days: Monitor WordPress user accounts for unauthorized administrator-level additions and review access logs for suspicious AJAX requests to 'install-imprint' endpoint; implement Web Application Firewall (WAF) rules to block unauthenticated requests to this endpoint if plugin removal is delayed. Within 30 days: Establish a plugin inventory management process and require security review before deploying third-party WordPress plugins.

WordPress CVE-2026-3596

EUVD-2026-23184 CRITICAL

Missing Authorization (CWE-862)

2026-04-16 Wordfence

Authentication Bypass WordPress Privilege Escalation

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 06:37 vuln.today

cvss_changed

Analysis Generated

Apr 16, 2026 - 06:00 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 05:45 euvd

EUVD-2026-23184

Analysis Generated

Apr 16, 2026 - 05:45 vuln.today

CVE Published

Apr 16, 2026 - 05:29 nvd

CRITICAL 9.8

DescriptionCVE.org

The Riaxe Product Customizer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.2. The plugin registers an unauthenticated AJAX action ('wp_ajax_nopriv_install-imprint') that maps to the ink_pd_add_option() function. This function reads 'option' and 'opt_value' from $_POST, then calls delete_option() followed by add_option() using these attacker-controlled values without any nonce verification, capability checks, or option name allowlist. This makes it possible for unauthenticated attackers to update arbitrary WordPress options, which can be leveraged for privilege escalation by enabling user registration and setting the default user role to administrator.

AnalysisAI

Unauthenticated remote attackers can escalate to administrator privileges on WordPress sites running Riaxe Product Customizer plugin ≤2.1.2. The plugin exposes an AJAX endpoint ('install-imprint') without authentication checks that allows arbitrary WordPress option manipulation, enabling attackers to create administrator accounts by modifying registration settings. CVSS 9.8 (Critical) reflects the complete site compromise potential. EPSS data not provided but exploitation requires only HTTP access to any vulnerable WordPress installation with this plugin active-no special conditions beyond plugin presence.

Technical ContextAI

WordPress options are key-value pairs stored in the wp_options database table that control site configuration, including security-critical settings like user registration ('users_can_register') and default role assignment ('default_role'). The plugin registers an AJAX action handler using 'wp_ajax_nopriv_install-imprint', where 'nopriv' explicitly makes the endpoint accessible to unauthenticated users. The vulnerable ink_pd_add_option() function reads POST parameters 'option' and 'opt_value' and directly passes them to WordPress core delete_option() and add_option() functions without validation. This violates WordPress security best practices requiring nonce verification (wp_verify_nonce()) and capability checks (current_user_can()). CWE-862 (Missing Authorization) accurately describes this root cause-the function performs privileged operations without verifying the caller's authority. The affected product per CPE is cpe:2.3:a:imprintnext:riaxe_product_customizer covering all versions through 2.1.2. Source code references point to riaxe-product-designer.php lines 183 (AJAX registration), 5045-5058 (vulnerable function implementation).

RemediationAI

No patched version is identified in the provided intelligence-trunk source code at https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/trunk/ still contains the vulnerable code at identical line numbers as version 2.1.2, indicating no fix has been committed as of this analysis. Organizations must immediately deactivate and remove the Riaxe Product Customizer plugin until a vendor patch is released. Compensating controls include Web Application Firewall rules blocking POST requests to /wp-admin/admin-ajax.php with action=install-imprint parameter, though this breaks legitimate plugin functionality. Network-level access control restricting WordPress admin area to trusted IPs reduces attack surface but does not eliminate risk since the AJAX endpoint is frontend-accessible. Check WordPress user lists for unexpected administrator accounts created with recently-registered email addresses, and audit wp_options table for unauthorized changes to 'users_can_register' and 'default_role' settings. Side effect of plugin removal: loss of all product customization functionality dependent on Riaxe-plan alternative solutions before remediation. Contact ImprintNext support for patch timeline or migration guidance.