Riaxe Product Customizer CVE-2026-3596

No special conditions-remote unauthenticated exploitation against default configurations of WordPress sites with Riaxe Product Customizer plugin versions ≤2.1.2 active. The vulnerable AJAX action 'install-imprint' is registered with 'wp_ajax_nopriv_' prefix, making it accessible without any authentication. No specific WordPress configuration, plugin settings, or feature enablement required beyond plugin installation. Attack succeeds against standard WordPress deployments regardless of theme, other plugins, or hosting environment. The only limiting factor is plugin presence: sites not using Riaxe Product Customizer are unaffected. No user interaction required (UI:N). Attack complexity is low (AC:L) because exploitation involves standard HTTP POST requests to a well-known WordPress endpoint with predictable parameters.

This represents critical real-world risk despite absence of EPSS/KEV data in the provided intelligence. CVSS 9.8 is justified: AV:N (remote exploitation via HTTP), AC:L (trivial-single POST request), PR:N (no authentication), UI:N (no user interaction), with complete CIA impact (H/H/H). The attack is fully automatable and requires zero prior access, making mass exploitation via internet-wide scanning viable. No EPSS score provided, but the technical profile (unauthenticated remote code execution equivalent through admin account creation) historically correlates with high exploitation probability once details are public. Wordfence reporting and public source code links in references indicate vulnerability details are fully disclosed. The SSVC technical impact is 'total' (full site control), exploitation is 'active' per public disclosure, and it is fully automatable. Priority should be IMMEDIATE for any organization running this plugin-the 48-hour remediation window applies. The only mitigating factor is limited install base compared to mainstream plugins, but any installation is a critical exposure.

Attacker identifies WordPress sites running Riaxe Product Customizer through plugin fingerprinting (version disclosure in HTML comments or predictable asset paths). They craft a POST request to /wp-admin/admin-ajax.php with parameters action=install-imprint, option=users_can_register, opt_value=1 to enable user registration, then a second request with option=default_role, opt_value=administrator to set new users as administrators. Finally, they register a new account through the standard WordPress registration form at /wp-login.php?action=register, receiving immediate administrator privileges. Total time from discovery to full site compromise: under 60 seconds with automated tooling. No proof-of-concept code is explicitly referenced in the intelligence, but the trivial exploitation complexity (documented AJAX action and straightforward WordPress API calls) means POC development requires minimal effort.