CVE-2026-3596criticalCWE-862

CVE-2026-3596: critical vulnerability in imprintnext Riaxe Product Customizer

Riaxe Product Customizer <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Options Update to Privilege Escalation via 'install-imprint' AJAX Action

Published

Follow this CVE+ Monitor Riaxe Product Customizer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.8%
The Riaxe Product Customizer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.2. The plugin registers an unauthenticated AJAX action ('wp_ajax_nopriv_install-imprint') that maps to the ink_pd_add_option() function. This function reads 'option' and 'opt_value' from $_POST, then calls delete_option() followed by add_option() using these attacker-controlled values without any nonce verification, capability checks, or option name allowlist. This makes it possible for unauthenticated attackers to update arbitrary WordPress options, which can be leveraged for privilege escalation by enabling user registration and setting the default user role to administrator.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
imprintnext · Riaxe Product Customizer
Related CVEs — imprintnext Riaxe Product Customizer

In the same product, most dangerous first.

CVE-2026-3599HIGHRiaxe Product Customizer <= 2.1.2 - Unauthenticated SQL Injection via 'options' Parameter Keys in product_dataEPSS 0.5%CVE-2026-3594MEDIUMRiaxe Product Customizer <= 2.4 - Unauthenticated Sensitive Information Disclosure via '/orders' REST API EndpointEPSS 0.5%CVE-2026-3595MEDIUMRiaxe Product Customizer <= 2.1.2 - Unauthenticated Arbitrary User Deletion via 'user_id' ParameterEPSS 0.4%