CVE-2026-3596: WordPress Riaxe Privilege Escalation Flaw

CVE-2026-3596 Overview

The Riaxe Product Customizer plugin for WordPress contains a critical Privilege Escalation vulnerability affecting all versions up to and including 2.1.2. The vulnerability exists due to an improperly secured AJAX action that allows unauthenticated attackers to modify arbitrary WordPress options, ultimately enabling complete site takeover through privilege escalation.

The plugin registers an unauthenticated AJAX action (wp_ajax_nopriv_install-imprint) that maps to the ink_pd_add_option() function. This function accepts attacker-controlled option and opt_value parameters from POST data and uses them directly in delete_option() and add_option() WordPress functions without implementing nonce verification, capability checks, or option name allowlisting.

Critical Impact

Unauthenticated attackers can modify arbitrary WordPress options to enable user registration and set the default user role to administrator, resulting in complete site compromise.

Affected Products

• Riaxe Product Customizer plugin for WordPress versions ≤ 2.1.2
• WordPress sites with the vulnerable plugin installed and active

Discovery Timeline

• April 16, 2026 - CVE-2026-3596 published to NVD
• April 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-3596

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization). The core issue stems from the plugin's failure to implement any form of access control on a sensitive administrative function. The ink_pd_add_option() function is exposed through WordPress's AJAX API via the wp_ajax_nopriv_install-imprint action hook, which allows unauthenticated users to invoke the function remotely.

When called, the function reads the option and opt_value parameters directly from the $_POST superglobal without any validation or sanitization. It then proceeds to delete any existing option with the specified name using delete_option() before creating a new option with the attacker-supplied value using add_option().

The impact is severe because WordPress stores critical configuration values as options, including users_can_register (controls whether new user registration is enabled) and default_role (determines the role assigned to newly registered users). By manipulating these options, an attacker can enable user registration and set the default role to administrator, then simply register a new account to gain full administrative access.

Root Cause

The root cause is the complete absence of authorization controls in the ink_pd_add_option() function. Specifically, the vulnerable code pattern includes:

1. Missing Nonce Verification: No wp_verify_nonce() check to prevent CSRF attacks
2. Missing Capability Checks: No current_user_can() verification to ensure only authorized users can modify options
3. Missing Option Allowlist: No validation to restrict which options can be modified through this endpoint
4. Unauthenticated AJAX Hook: Use of wp_ajax_nopriv_ prefix allows any visitor to trigger the action

The vulnerable code is located in riaxe-product-designer.php at line 5045-5058, where the function accepts user input and passes it directly to WordPress option management functions. For technical details, see the WordPress Plugin Code Review.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending a crafted HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to install-imprint along with malicious option and opt_value parameters.

A typical attack scenario involves two sequential requests:

1. First, the attacker sets users_can_register option to 1 to enable user registration
2. Next, the attacker sets default_role option to administrator to ensure new registrations receive admin privileges

After these options are modified, the attacker simply navigates to the WordPress registration page and creates a new account, which is automatically assigned administrator privileges. This grants complete control over the WordPress installation, including the ability to install malicious plugins, modify themes, access sensitive data, and potentially pivot to the underlying server infrastructure.

Detection Methods for CVE-2026-3596

Indicators of Compromise

• Unexpected POST requests to /wp-admin/admin-ajax.php with action=install-imprint in server access logs
• Modification of users_can_register or default_role options in wp_options database table without legitimate administrative action
• Newly created administrator accounts that were not authorized by site administrators
• Changes to user registration settings without corresponding admin panel activity

Detection Strategies

• Monitor web server access logs for POST requests to admin-ajax.php containing the install-imprint action parameter
• Implement file integrity monitoring on wp_options table to detect unauthorized changes to critical options like users_can_register, default_role, and admin_email
• Configure alerting for new administrator account creation, especially from unexpected IP addresses or during unusual hours
• Deploy a Web Application Firewall (WAF) rule to block requests matching the exploit pattern targeting the vulnerable AJAX endpoint

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX requests and review logs for suspicious patterns targeting the install-imprint action
• Implement database activity monitoring to track changes to the wp_options table, particularly for security-sensitive options
• Regularly audit the WordPress user list for unauthorized accounts with elevated privileges
• Configure SentinelOne Singularity to monitor for web shell deployment and suspicious PHP process execution following potential compromise

How to Mitigate CVE-2026-3596

Immediate Actions Required

• Immediately deactivate and remove the Riaxe Product Customizer plugin from all WordPress installations until a patched version is available
• Audit the wp_options table for unauthorized modifications, specifically checking users_can_register and default_role values
• Review all administrator accounts and remove any unauthorized users that may have been created through exploitation
• Reset passwords for all legitimate administrator accounts as a precautionary measure

Patch Information

At the time of publication, no official patch has been released by the vendor for CVE-2026-3596. Organizations using the Riaxe Product Customizer plugin should take immediate action to remove or disable the plugin until a security update is available.

For ongoing updates, monitor the Wordfence Vulnerability Report and the official WordPress plugin repository for security advisories.

Workarounds

• Remove or deactivate the Riaxe Product Customizer plugin entirely from WordPress installations
• If the plugin cannot be removed, implement a WAF rule to block all requests to admin-ajax.php containing action=install-imprint
• Restrict access to /wp-admin/admin-ajax.php at the web server level to authenticated users only (may break legitimate plugin functionality)
• Consider implementing a WordPress security plugin that provides additional authorization checks on AJAX endpoints

# Apache .htaccess rule to block the vulnerable endpoint
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php$ [NC]
RewriteCond %{QUERY_STRING} action=install-imprint [NC,OR]
RewriteCond %{REQUEST_BODY} action=install-imprint [NC]
RewriteRule .* - [F,L]
</IfModule>