CVE-2026-3596 - Vulnerability Analysis

Overview

Riaxe Product Customizer plugin for WordPress <= 2.1.2 contains a privilege escalation caused by unauthenticated AJAX action 'wp_ajax_nopriv_install-imprint' allowing arbitrary option updates without verification, letting unauthenticated attackers escalate privileges.

Severity & Score

Impact

Unauthenticated attackers can escalate privileges by modifying WordPress options, potentially gaining administrator access.

Mitigation

Update to a version later than 2.1.2 or apply patches that add nonce verification and capability checks.

References

• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/trunk/riaxe-product-designer.php#L5058
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/tags/2.1.2/riaxe-product-designer.php#L5047
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/trunk/riaxe-product-designer.php#L5045
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/trunk/riaxe-product-designer.php#L5047
• https://www.wordfence.com/threat-intel/vulnerabilities/id/271a35fb-56b7-4d6b-bccc-fea1227d0913?source=cve
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/tags/2.1.2/riaxe-product-designer.php#L183
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/tags/2.1.2/riaxe-product-designer.php#L5045
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/tags/2.1.2/riaxe-product-designer.php#L5046
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/tags/2.1.2/riaxe-product-designer.php#L5058
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/trunk/riaxe-product-designer.php#L183
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/trunk/riaxe-product-designer.php#L5046

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner