EUVD-2026-20105
GHSA-w5hq-hr8w-m998
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS score of 5.3 reflects a medium-severity vulnerability with network attack vector, low complexity, no privilege requirements, and confidentiality impact (CWE-200). The attack requires no user interaction and can be automated at scale. Although the CVSS score is moderate, the real-world risk is notably high: the endpoint exposes personally identifiable information (customer names, order histories) and transactional details that could enable identity theft, targeted phishing, competitive intelligence gathering, or GDPR/privacy regulation violations. The vulnerability is unauthenticated and trivial to exploit-any attacker can craft HTTP GET requests to the REST endpoint from anywhere on the internet. No public exploit code or active exploitation has been reported at time of analysis, but the low barrier to discovery and exploitation means affected WordPress stores should be prioritized for patching. SSVC assessment: exploitation is relatively trivial given the endpoint's simplicity; the technical impact is moderate but could cascade to GDPR/compliance violations. |
| Exploit ScenarioDerived | An attacker discovering the WordPress site runs Riaxe Product Customizer can issue an unauthenticated HTTP GET request to 'https://target-store.com/wp-json/InkXEProductDesignerLite/orders' from their browser or via curl/automated tools. The endpoint responds with a JSON payload containing a complete list of customer first names, last names, customer IDs, order IDs, totals, dates, currencies, and order statuses. The attacker can harvest this data in bulk, building a customer database for phishing campaigns, social engineering, or resale on underground markets. Because the endpoint has no rate limiting mentioned in available data, the attacker can extract all historical orders without triggering alerts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Riaxe Product Customizer plugin for WordPress versions up to 2.4 exposes sensitive WooCommerce customer and order data through an unauthenticated REST API endpoint due to a missing permission callback. Attackers can query the '/wp-json/InkXEProductDesignerLite/orders' endpoint to retrieve customer names, order IDs, totals, dates, and statuses without authentication. No public exploit code or active exploitation has been confirmed at time of analysis.
RemediationAI
Update the Riaxe Product Customizer plugin to a patched version released after 2.4. Site administrators should navigate to the WordPress dashboard, go to Plugins, and update the plugin to the latest available version provided by ImprintNext. If no patched version is available at time of update, immediately disable the plugin until a fix is released. As an interim mitigation, site administrators can use a Web Application Firewall (WAF) or .htaccess rules to block access to the '/wp-json/InkXEProductDesignerLite/orders' endpoint, though this requires manual configuration and does not address the underlying code defect. Monitor the Wordfence threat intelligence feed and WordPress plugin repository for patch announcements from ImprintNext.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the Riaxe Product Customizer plugin's REST API endpoint registration, which implements CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The endpoint is registered with 'permission_callback' set to '__return_true', a PHP function that unconditionally returns true, bypassing WordPress's standard authentication and authorization mechanisms. When accessed via '/wp-json/InkXEProductDesignerLite/orders', the endpoint queries WooCommerce order tables directly and serializes sensitive customer and transactional data in JSON format. The CPE identifier (cpe:2.3:a:imprintnext:riaxe_product_customizer:*:*:*:*:*:*:*:*) indicates all versions of the plugin are affected. This is a classic information disclosure flaw where a REST endpoint intended for internal or authenticated use is inadvertently exposed to unauthenticated clients via WordPress's REST API infrastructure.
Know when Riaxe Product Customizer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Riaxe Product Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4 via the '/wp-json/InkXEProductDesignerLite/orders' REST API endpoint. The endpoint is registered with 'permission_callback' set to '__return_true', meaning no authentication or authorization checks are performed. The endpoint queries WooCommerce order data from the database and returns it to the requester, including customer first and last names, customer IDs, order IDs, order totals, order dates, currencies, and order statuses. This makes it possible for unauthenticated attackers to extract sensitive customer and order information from the WooCommerce store.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Riaxe Product Customizer
View allUnauthenticated remote attackers can escalate to administrator privileges on WordPress sites running Riaxe Product Custo
SQL injection in Riaxe Product Customizer for WordPress (all versions ≤2.1.2) allows unauthenticated remote attackers to
Riaxe Product Customizer plugin for WordPress versions up to 2.1.2 allows unauthenticated attackers to delete arbitrary
Exploit-DB