Riaxe Product Customizer CVE-2026-3599

No special conditions required for exploitation. The vulnerability is exploitable against default installations of Riaxe Product Customizer plugin versions ≤2.1.2 without any non-default configuration. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms: network-accessible REST API endpoint, low attack complexity, no authentication required, no user interaction needed. The /wp-json/ REST API namespace is enabled by default in WordPress and publicly accessible unless explicitly restricted via security plugins or server configuration. Limiting factors are minimal: attacker must know the specific endpoint path (/wp-json/InkXEProductDesignerLite/add-item-to-cart) and parameter structure (product_data with nested options keys), both of which are discoverable through WordPress plugin repository source code examination or REST API enumeration. Sites that have disabled WordPress REST API entirely or implemented IP whitelisting for admin functions would block exploitation, but these are non-default hardening measures.

Real-world risk is HIGH despite no confirmed active exploitation. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates trivial exploitation conditions: remotely accessible, low complexity, no authentication, no user interaction. The confidentiality impact is HIGH (C:H) with no integrity or availability impact, meaning attackers can read sensitive data but not modify or destroy it. WordPress plugins with SQL injection vulnerabilities historically see rapid exploitation once disclosed, as automated scanners can easily identify WordPress installations and test vulnerable endpoints. The REST API nature makes this trivially scriptable. Mitigating factors: exploitation requires knowledge of the specific endpoint structure and parameter format, which is documented in the plugin source code (publicly accessible via WordPress Trac references). The absence of EPSS score and KEV listing suggests no widespread exploitation campaigns detected yet, but Wordfence's public disclosure will likely trigger reconnaissance activity. SSVC assessment: exploitation status currently proof-of-concept level (publicly disclosed technical details), automatable (yes, REST API enumeration is trivial), technical impact (partial data exfiltration). Priority depends on whether WooCommerce/product customization features are actively used. Sites not utilizing the plugin's cart functionality may have reduced attack surface, but the endpoint may still be reachable.

An unauthenticated attacker identifies a WordPress site running Riaxe Product Customizer by fingerprinting the /wp-json/InkXEProductDesignerLite/add-item-to-cart endpoint. They craft a POST request with malicious SQL payloads injected into the 'options' parameter keys within 'product_data', such as: {"product_data": {"options": {"color' UNION SELECT user_login,user_pass FROM wp_users--": "value"}}}. The vulnerable code constructs a SQL query using unsanitized array keys, executing the injected UNION statement. The attacker extracts WordPress administrator credentials, site configuration secrets, or customer PII from the database, then uses this data for account takeover or further attacks. Given the low attack complexity and public source code availability, exploitation can be automated via vulnerability scanners targeting WordPress installations.