CVE-2026-3594

Name of the Vulnerable Software and Affected Versions Riaxe Product Customizer plugin for WordPress versions up to and including 2.4

Description The Riaxe Product Customizer plugin for WordPress is susceptible to exposure of sensitive information. The '/wp-json/InkXEProductDesignerLite/orders' API endpoint lacks authentication or authorization checks due to its 'permission callback' being set to ' return true'. This allows unauthenticated attackers to retrieve customer first and last names, customer IDs, order IDs, order totals, order dates, currencies, and order statuses directly from the database.

Recommendations Update the Riaxe Product Customizer plugin to a version later than 2.4.