PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-3594 imprintnext CVE debrief

The Riaxe Product Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4 via the '/wp-json/InkXEProductDesignerLite/orders' REST API endpoint. This vulnerability allows unauthenticated access to WooCommerce order data, including customer names, IDs, order IDs, totals, dates, currencies, and statuses. The endpoint is registered with 'permission_callback' set to '__return_true', meaning no authentication or authorization checks are performed. This makes it possible for unauthenticated attackers to extract sensitive customer and order information from the WooCommerce store. Affected administrators should prioritize updating the plugin and restricting access to the vulnerable endpoint.

Vendor
imprintnext
Product
Riaxe Product Customizer
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

Administrators of WordPress installations using the Riaxe Product Customizer plugin, especially those handling customer data and orders, should be aware of this vulnerability. They should review their installations for exposure, update the plugin to a version beyond 2.4, and implement additional authentication and authorization checks for sensitive data access. Security teams and vulnerability management teams should also be aware of this vulnerability and prioritize remediation efforts.

Technical summary

The Riaxe Product Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure due to an unauthenticated REST API endpoint. The '/wp-json/InkXEProductDesignerLite/orders' endpoint, registered with 'permission_callback' set to '__return_true', allows unauthenticated access to WooCommerce order data, including customer names, IDs, order IDs, totals, dates, currencies, and statuses. This vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. The endpoint queries WooCommerce order data from the database and returns it to the requester without any authentication or authorization checks.

Defensive priority

Medium priority due to the potential for data exposure.

Recommended defensive actions

  • Update the Riaxe Product Customizer plugin to a version beyond 2.4.
  • Restrict access to the '/wp-json/InkXEProductDesignerLite/orders' endpoint.
  • Monitor for suspicious API requests.
  • Review and limit the data exposed through API endpoints.
  • Implement additional authentication and authorization checks for sensitive data access.
  • Perform a thorough review of WooCommerce order data exposure.
  • Track exceptions and retest remediated assets.

Evidence notes

The vulnerability was reported by [email protected]. The CVE record was published on 2026-04-08T07:16:21.620Z and last modified on 2026-07-24T21:10:00.143Z. The Riaxe Product Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure due to an unauthenticated REST API endpoint. The endpoint queries WooCommerce order data from the database and returns it to the requester, including customer first and last names, customer IDs, order IDs, order totals, order dates, currencies, and order statuses. Evidence limits suggest that defenders verify WooCommerce order data exposure and review API endpoint access controls.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-08T07:16:21.620Z and has not been modified since then.