What is the CVSS score of CVE-2026-3599?

CVE-2026-3599 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3599?

Riaxe Product Customizer for WordPress versions 2.1.2 and below contain an unauthenticated SQL injection vulnerability in the REST API that allows attackers to extract sensitive database contents…

How to fix or mitigate CVE-2026-3599?

Within 24 hours: Identify all WordPress instances running Riaxe Product Customizer and document current versions via plugin inventory or WPScan audits. Within 7 days: Disable or remove the plugin from all production environments running versions ≤2.1.2; if plugin functionality is required, migrate to an alternative product customizer with current security patches or contact Riaxe for timeline on version 2.1.3+. Within 30 days: Conduct database audit for unauthorized access logs (REST API calls to /wp-json/InkXEProductDesignerLite/add-item-to-cart with suspicious 'options' parameter values); review and reset database credentials if exposure is suspected.

WordPress CVE-2026-3599

EUVD-2026-23186 HIGH

SQL Injection (CWE-89)

2026-04-16 Wordfence

WordPress SQLi

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 06:37 vuln.today

cvss_changed

Analysis Generated

Apr 16, 2026 - 06:00 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 05:45 euvd

EUVD-2026-23186

Analysis Generated

Apr 16, 2026 - 05:45 vuln.today

CVE Published

Apr 16, 2026 - 05:29 nvd

HIGH 7.5

DescriptionCVE.org

The Riaxe Product Customizer plugin for WordPress is vulnerable to SQL Injection via the 'options' parameter keys within 'product_data' of the /wp-json/InkXEProductDesignerLite/add-item-to-cart REST API endpoint in all versions up to, and including, 2.1.2. This is due to insufficient escaping on the user-supplied parameter and insufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL injection in Riaxe Product Customizer for WordPress (all versions ≤2.1.2) allows unauthenticated remote attackers to extract sensitive database contents via crafted REST API requests. The vulnerability exists in the /wp-json/InkXEProductDesignerLite/add-item-to-cart endpoint where the 'options' parameter keys within 'product_data' lack proper SQL escaping. CVSS 7.5 (High) with attack vector network/low complexity/no authentication required. Wordfence discovery indicates active researcher attention. No CISA KEV listing or public exploit code identified at time of analysis, but EPSS data unavailable for risk calibration.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a WordPress plugin's custom REST API endpoint. The affected component is Riaxe Product Customizer (also known as InkXE Product Designer Lite) by ImprintNext, used for WooCommerce product customization. The flaw occurs in the REST API route handler at /wp-json/InkXEProductDesignerLite/add-item-to-cart, specifically in code processing the 'options' parameter keys nested within 'product_data'. Source code references point to vulnerable logic in riaxe-product-designer.php around lines 3576, 6808, and 6876. The plugin fails to sanitize user-controlled array keys before incorporating them into SQL queries, violating WordPress security best practices that require using wpdb::prepare() with proper placeholders for all dynamic query components. WordPress REST API endpoints are publicly accessible by default unless explicitly restricted, making this a remote attack surface. The vulnerability allows SQL query manipulation through parameter pollution, enabling UNION-based or Boolean-based blind SQL injection techniques to extract arbitrary database content including WordPress user credentials, site secrets, and custom application data.

RemediationAI

Immediately update to a patched version of Riaxe Product Customizer if available from the WordPress plugin repository or vendor (ImprintNext). As of this analysis, no patched release version is confirmed in the provided data; consult the plugin's official WordPress page and Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a36c9a7e-830d-4a92-a330-29279387b3be for update availability. If no patch exists, implement these compensating controls: (1) Disable the plugin entirely if product customization features are not business-critical, eliminating the attack surface. (2) Use a Web Application Firewall (WAF) rule to block requests to /wp-json/InkXEProductDesignerLite/add-item-to-cart containing suspicious SQL syntax patterns in the 'product_data' parameter (trade-off: may cause false positives for legitimate complex product options). (3) Restrict REST API access using WordPress security plugins (e.g., Wordfence, iThemes Security) to authenticated users only, though this breaks unauthenticated cart functionality (trade-off: impacts anonymous shoppers). (4) Implement database-level monitoring to detect anomalous SQL queries with UNION/SELECT patterns originating from WordPress database user. Review vulnerable source code sections at https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/trunk/riaxe-product-designer.php lines 3576, 6808, 6876 to understand exploit vectors.