CVE-2026-3594: Riaxe Product Customizer Info Disclosure

CVE-2026-3594 Overview

The Riaxe Product Customizer plugin for WordPress contains a Sensitive Information Exposure vulnerability in all versions up to and including 2.4. This security flaw exists in the /wp-json/InkXEProductDesignerLite/orders REST API endpoint, which is improperly configured with permission_callback set to __return_true. This configuration means no authentication or authorization checks are performed when the endpoint is accessed.

The vulnerable endpoint directly queries WooCommerce order data from the database and returns it to any requester without verification. Exposed data includes customer first and last names, customer IDs, order IDs, order totals, order dates, currencies, and order statuses.

Critical Impact

Unauthenticated attackers can extract sensitive customer and order information from WooCommerce stores running the vulnerable plugin, potentially leading to privacy breaches, targeted phishing attacks, and compliance violations.

Affected Products

• Riaxe Product Customizer plugin for WordPress versions up to and including 2.4
• WordPress installations using WooCommerce with the affected plugin
• Any e-commerce store utilizing the vulnerable REST API endpoint

Discovery Timeline

• 2026-04-08 - CVE-2026-3594 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-3594

Vulnerability Analysis

This vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The core issue lies in the improper implementation of WordPress REST API endpoint security. WordPress provides the permission_callback parameter for REST API routes to define access control logic. When set to __return_true, the endpoint becomes publicly accessible without any authentication requirements.

The attack can be executed remotely over the network with low complexity. No user interaction or special privileges are required to exploit this vulnerability. The confidentiality impact allows attackers to access sensitive order and customer data, though the vulnerability does not enable modification of data or affect system availability.

Root Cause

The root cause is an insecure implementation of the REST API endpoint registration in the riaxe-product-designer.php file. The developer used WordPress's built-in __return_true function as the permission_callback, which unconditionally returns true and bypasses all authentication and authorization checks. This is a common WordPress development anti-pattern where convenience is prioritized over security.

Proper implementation would require a permission callback that verifies the requesting user has appropriate capabilities (such as manage_woocommerce or edit_shop_orders) before returning order data.

Attack Vector

An attacker can exploit this vulnerability by sending unauthenticated HTTP GET requests to the vulnerable REST API endpoint. The attack requires no prior authentication or access to the WordPress installation.

The exploitation process involves:

1. Identifying a WordPress site running the Riaxe Product Customizer plugin
2. Sending a direct HTTP request to the /wp-json/InkXEProductDesignerLite/orders endpoint
3. Receiving a JSON response containing sensitive WooCommerce order data including customer names, order totals, dates, and statuses

The attacker can then use this harvested data for targeted phishing campaigns, identity theft, competitive intelligence gathering, or further attacks against the store's customers.

Detection Methods for CVE-2026-3594

Indicators of Compromise

• Unusual or high-volume requests to /wp-json/InkXEProductDesignerLite/orders endpoint from unknown IP addresses
• Access logs showing unauthenticated GET requests to the vulnerable endpoint returning 200 status codes
• Requests to the endpoint originating from automated tools or scanners (identifiable via User-Agent strings)

Detection Strategies

• Monitor web server access logs for requests to /wp-json/InkXEProductDesignerLite/orders without corresponding authenticated sessions
• Implement Web Application Firewall (WAF) rules to flag or block unauthenticated access attempts to the vulnerable endpoint
• Review WordPress audit logs for REST API access patterns targeting InkXEProductDesignerLite routes

Monitoring Recommendations

• Enable detailed logging for WordPress REST API requests and integrate with SIEM solutions
• Set up alerts for burst or anomalous traffic patterns to WooCommerce-related API endpoints
• Conduct regular vulnerability scans of WordPress installations to identify insecure plugin configurations

How to Mitigate CVE-2026-3594

Immediate Actions Required

• Update the Riaxe Product Customizer plugin to a patched version (when available from the vendor)
• Temporarily disable the Riaxe Product Customizer plugin if it is not critical to business operations
• Implement WAF rules to block unauthenticated access to /wp-json/InkXEProductDesignerLite/orders
• Review access logs to determine if the vulnerability has already been exploited

Patch Information

Administrators should check the WordPress Plugin Repository for the latest version of the Riaxe Product Customizer plugin that addresses this vulnerability. Monitor the Wordfence Vulnerability Report for patch availability announcements.

Workarounds

• Add a custom WordPress filter or mu-plugin to override the endpoint's permission callback and require authentication
• Use .htaccess or Nginx configuration rules to restrict access to the vulnerable endpoint by IP address
• Implement a security plugin like Wordfence to monitor and block suspicious REST API access patterns

# Nginx configuration to block unauthenticated access to vulnerable endpoint
location ~* /wp-json/InkXEProductDesignerLite/orders {
    # Allow only authenticated requests from trusted IPs
    allow 192.168.1.0/24;  # Replace with your admin IP range
    deny all;
}