CVE-2026-3596: Riaxe Product Customizer
CVE-2026-3596 is a missing authorization flaw (CWE-862) in the Riaxe Product Customizer WordPress plugin, affecting versions up to and including 2.1.2. According to the record, an unauthenticated AJAX action can update arbitrary WordPress options, which could be used to escalate privileges. The CNA rates it CVSS 3.1 9.8 (Critical), and no fixed version is listed in the sources consulted.
Overview
CVE-2026-3596 affects the Riaxe Product Customizer plugin for WordPress. The record describes it as vulnerable to privilege escalation in all versions up to and including 2.1.2. The CNA classifies the weakness as CWE-862, Missing Authorization, and states that an unauthenticated AJAX action accepts option names and values without authorization or nonce checks.
Impact
- The record states that unauthenticated users could update arbitrary WordPress options.
- It states this could be leveraged for privilege escalation, for example by changing settings that govern user registration and the default user role.
- The CNA assigns CVSS 3.1 base score 9.8 (Critical) with high confidentiality, integrity and availability impact.
Affected products and versions
- Imprintnext Riaxe Product Customizer, versions up to and including 2.1.2.
- No fixed version is listed in the record, so the availability of a fix is unknown.
Exploitation status
This CVE is not listed in the CISA KEV catalog in the record. No confirmed active exploitation appears in the sources consulted. The SSVC data in the record marks exploitation as none and automatable as no. The EPSS probability is 0.00837 with a percentile of 0.56662.
Remediation and mitigation
- Identify every site running the plugin and compare the installed version with 2.1.2 or earlier.
- Because the record lists no fixed version, check the vendor and the WordPress plugin repository for an updated release.
- Until a fix is confirmed, consider deactivating or removing the plugin where it is not essential.
- Review user registration and default role settings for unexpected changes, and restrict administrative access.
- Any perimeter restriction on the affected endpoint would be a temporary, unverified measure and should not replace patching.
Detection guidance
- Review web server and WordPress logs for unauthenticated requests to the admin AJAX endpoint that reference this plugin's action name.
- Audit changes to the WordPress options table, particularly user registration and default role settings.
- Look for newly created administrator accounts and for configuration changes not tied to an authenticated administrator session.
Limitations of the available information
- The record does not list fixed versions, patches or a full vendor advisory.
- The exact set of options that can be changed is described only at a summary level.
- The source status is Deferred, and no KEV listing or exploitation reports were found in the consulted sources.
- Only the references included in the record were consulted.
Frequently asked questions
Which versions of the Riaxe Product Customizer plugin are affected by CVE-2026-3596?
The record states that all versions up to and including 2.1.2 are affected.
Is there a fixed version available?
The record does not list a fixed version. The availability of a fix is unknown, so check the vendor and the WordPress plugin repository for updates.
Is this vulnerability being actively exploited?
This CVE is not listed in the CISA KEV catalog in the record, and no confirmed active exploitation appears in the sources consulted.
What is the severity of this issue?
The CNA assigns a CVSS 3.1 base score of 9.8, rated Critical, with high impact on confidentiality, integrity and availability.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.