CVE-2026-3595: WordPress Riaxe Auth Bypass Vulnerability

CVE-2026-3595 Overview

The Riaxe Product Customizer plugin for WordPress contains a critical authorization bypass vulnerability affecting all versions up to and including 2.1.2. This security flaw allows unauthenticated attackers to delete arbitrary WordPress user accounts, including administrator accounts, potentially leading to complete site lockout and significant data loss.

Critical Impact

Unauthenticated attackers can delete any WordPress user account, including administrators, resulting in complete site lockout and irreversible data loss.

Affected Products

• Riaxe Product Customizer plugin for WordPress versions up to and including 2.1.2
• WordPress installations using the vulnerable Riaxe Product Customizer plugin
• Any WordPress site with the InkXE Product Designer Lite REST API endpoint exposed

Discovery Timeline

• April 16, 2026 - CVE-2026-3595 published to NVD
• April 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-3595

Vulnerability Analysis

This authorization bypass vulnerability (CWE-862: Missing Authorization) stems from improper REST API endpoint security configuration in the Riaxe Product Customizer plugin. The plugin registers a REST API route at POST /wp-json/InkXEProductDesignerLite/customer/delete_customer without implementing a proper permission_callback function. When WordPress REST API endpoints lack a permission_callback, WordPress defaults to allowing unauthenticated access to the endpoint, creating a significant security gap.

The inkxe_delete_customer() callback function accepts an array of user IDs from the request body and passes each one directly to the WordPress core function wp_delete_user() without performing any authentication or authorization checks. This design flaw means that any external attacker can craft a malicious HTTP POST request to delete user accounts without any credentials.

Root Cause

The root cause of this vulnerability is the missing permission_callback parameter in the REST API route registration combined with the absence of authorization checks within the inkxe_delete_customer() callback function. WordPress REST API best practices require developers to explicitly define permission callbacks that verify whether the requesting user has appropriate capabilities to perform the action. The plugin developer failed to implement this security control, leaving the user deletion functionality completely exposed to unauthenticated access.

Attack Vector

The attack vector is network-based and requires no privileges, user interaction, or prior authentication. An attacker can exploit this vulnerability by sending a crafted HTTP POST request to the vulnerable REST API endpoint. The request body contains an array of target user IDs, which the plugin processes without validation, passing them directly to wp_delete_user(). This allows an attacker to enumerate and delete user accounts systematically, including administrator accounts, which would lock out legitimate site administrators and potentially cause irreversible data loss.

The vulnerability can be exploited remotely by sending a POST request to /wp-json/InkXEProductDesignerLite/customer/delete_customer with a JSON body containing the user IDs to delete. No special tools or complex exploitation techniques are required—a simple HTTP client or command-line tool like curl is sufficient. For technical details regarding the vulnerable code, refer to the WordPress Plugin Code Reference and the Wordfence Vulnerability Advisory.

Detection Methods for CVE-2026-3595

Indicators of Compromise

• Unexpected HTTP POST requests to /wp-json/InkXEProductDesignerLite/customer/delete_customer from external IP addresses
• Unexplained deletion of WordPress user accounts, particularly administrator accounts
• Access logs showing unauthenticated requests to the InkXEProductDesignerLite REST API endpoints
• Sudden loss of user data or inability for administrators to log in to the WordPress dashboard

Detection Strategies

• Monitor web server access logs for POST requests to the vulnerable REST API endpoint
• Implement Web Application Firewall (WAF) rules to detect and block unauthorized requests to /wp-json/InkXEProductDesignerLite/customer/delete_customer
• Set up alerts for any user deletion events in WordPress, especially for privileged accounts
• Use security plugins that monitor REST API activity for anomalous unauthenticated access patterns

Monitoring Recommendations

• Enable comprehensive logging for WordPress REST API requests and responses
• Configure real-time alerting for user account modifications or deletions
• Regularly audit WordPress user accounts to detect unauthorized changes
• Deploy endpoint detection solutions capable of identifying malicious HTTP requests targeting known vulnerable endpoints

How to Mitigate CVE-2026-3595

Immediate Actions Required

• Immediately deactivate the Riaxe Product Customizer plugin until a patched version is available
• Review WordPress user accounts to ensure no unauthorized deletions have occurred
• Restore any deleted administrator accounts from backups if compromise is suspected
• Implement WAF rules to block requests to the vulnerable REST API endpoint

Patch Information

Organizations using the Riaxe Product Customizer plugin should check for updates that address this authorization bypass vulnerability. The vulnerability affects all versions up to and including 2.1.2. Users should monitor the official WordPress plugin repository and the Wordfence Vulnerability Advisory for patch release announcements.

Workarounds

• Temporarily disable or uninstall the Riaxe Product Customizer plugin until a security update is released
• Use .htaccess or web server configuration to block access to the vulnerable REST API endpoint
• Deploy a WAF rule to deny all requests to /wp-json/InkXEProductDesignerLite/customer/delete_customer
• Restrict REST API access using plugins that enforce authentication on all custom endpoints

# Apache .htaccess configuration to block the vulnerable endpoint
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-json/InkXEProductDesignerLite/customer/delete_customer [NC]
    RewriteRule .* - [F,L]
</IfModule>