CVE-2026-3599: Riaxe Product Customizer SQLi Vulnerability

CVE-2026-3599 Overview

The Riaxe Product Customizer plugin for WordPress contains a SQL Injection vulnerability in the /wp-json/InkXEProductDesignerLite/add-item-to-cart REST API endpoint. The vulnerability exists in the options parameter keys within the product_data parameter. Due to insufficient escaping of user-supplied input and inadequate preparation of the SQL query, unauthenticated attackers can append malicious SQL queries to extract sensitive information from the WordPress database.

Critical Impact

Unauthenticated attackers can exploit this SQL Injection vulnerability to extract sensitive data from the database, including user credentials, personal information, and potentially gain unauthorized access to the WordPress site.

Affected Products

• Riaxe Product Customizer plugin for WordPress versions up to and including 2.1.2
• WordPress sites using the InkXEProductDesignerLite REST API endpoint
• E-commerce sites utilizing the product customization functionality

Discovery Timeline

• 2026-04-16 - CVE CVE-2026-3599 published to NVD
• 2026-04-16 - Last updated in NVD database

Technical Details for CVE-2026-3599

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) affects the Riaxe Product Customizer plugin's REST API endpoint used for adding customized products to the shopping cart. The vulnerability arises from improper handling of user-controlled data in the options parameter keys within the product_data object submitted to the /wp-json/InkXEProductDesignerLite/add-item-to-cart endpoint.

The plugin fails to properly sanitize and escape user input before incorporating it into SQL queries. Additionally, the existing SQL queries lack proper prepared statements with parameterized queries, which is the standard defense against SQL Injection attacks in WordPress development using the $wpdb->prepare() method.

Since the vulnerable endpoint is accessible without authentication, any remote attacker can craft malicious requests to exploit this vulnerability. The attack allows for data exfiltration from the WordPress database, potentially exposing user credentials, customer data, order information, and other sensitive business data.

Root Cause

The root cause of this vulnerability is twofold:

1. Insufficient Input Escaping: The plugin does not adequately sanitize or escape user-supplied values in the options parameter keys before using them in database queries.

2. Missing Prepared Statements: The SQL queries constructed in the vulnerable code paths (riaxe-product-designer.php at lines 3576, 6808, and 6876) do not utilize WordPress's $wpdb->prepare() function to properly parameterize queries and prevent SQL Injection.

The vulnerable code paths can be examined in the WordPress plugin repository at line 3576, line 6808, and line 6876.

Attack Vector

The vulnerability is exploited via network-based attacks targeting the REST API endpoint. An attacker can craft malicious HTTP POST requests to the /wp-json/InkXEProductDesignerLite/add-item-to-cart endpoint with specially crafted product_data containing SQL Injection payloads in the options parameter keys.

The attack requires no authentication and no user interaction, making it particularly dangerous for publicly accessible WordPress sites. Successful exploitation allows attackers to append additional SQL queries to existing queries, enabling them to extract sensitive information from the database through techniques such as UNION-based injection, blind SQL injection, or error-based injection depending on the database configuration.

For detailed technical analysis, refer to the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-3599

Indicators of Compromise

• Unusual or malformed requests to /wp-json/InkXEProductDesignerLite/add-item-to-cart endpoint containing SQL syntax characters
• Database query errors or unusual query patterns in MySQL/MariaDB logs
• Unexpected data exfiltration or database access patterns from web server processes
• HTTP POST requests with product_data parameters containing single quotes, UNION statements, or other SQL keywords

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect SQL Injection patterns in REST API requests
• Implement logging and monitoring for all requests to the InkXEProductDesignerLite REST API endpoints
• Review web server access logs for suspicious POST requests containing SQL metacharacters in the request body
• Enable database query logging to identify anomalous or malicious SQL query patterns

Monitoring Recommendations

• Configure real-time alerting for SQL Injection attack signatures targeting WordPress REST API endpoints
• Monitor database query execution times and patterns for anomalies indicative of injection attacks
• Implement rate limiting on REST API endpoints to mitigate automated exploitation attempts
• Use SentinelOne Singularity Platform for endpoint detection and response to identify post-exploitation activities

How to Mitigate CVE-2026-3599

Immediate Actions Required

• Update the Riaxe Product Customizer plugin to a patched version immediately if available
• If no patch is available, consider temporarily deactivating the plugin until a fix is released
• Implement WAF rules to block SQL Injection attempts targeting the vulnerable endpoint
• Review database access logs for signs of prior exploitation and potential data breach

Patch Information

Organizations using the Riaxe Product Customizer plugin should monitor the WordPress Plugin Repository for security updates. The vulnerability affects all versions up to and including 2.1.2. Check for updates in your WordPress admin dashboard under Plugins > Installed Plugins.

Workarounds

• Temporarily disable the Riaxe Product Customizer plugin if it is not critical to business operations
• Implement a WAF rule to sanitize or block requests containing SQL injection patterns to the affected endpoint
• Restrict access to the REST API endpoint using IP whitelisting or authentication requirements if possible
• Consider using a WordPress security plugin like Wordfence to add an additional layer of protection

# Example: Add .htaccess rules to restrict access to the vulnerable endpoint
# Add to your WordPress .htaccess file

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-json/InkXEProductDesignerLite/add-item-to-cart [NC]
    RewriteCond %{QUERY_STRING} (union|select|insert|update|delete|drop|concat|char|benchmark) [NC,OR]
    RewriteCond %{REQUEST_BODY} (union|select|insert|update|delete|drop|concat|char|benchmark) [NC]
    RewriteRule .* - [F,L]
</IfModule>