CVE-2026-3595

The Riaxe Product Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.2. This is due to the plugin registering a REST API route at POST /wp-json/InkXEProductDesignerLite/customer/delete_customer without a permission_callback, causing WordPress to default to allowing unauthenticated access, and the inkxe_delete_customer() callback function taking an array of user IDs from the request body and passing each one directly to wp_delete_user() without any authentication or authorization checks. This makes it possible for unauthenticated attackers to delete arbitrary WordPress user accounts, including administrator accounts, leading to complete site lockout and data loss.

• CWE-862

• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/tags/2.1.2/riaxe-product-designer.php#L2993
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/tags/2.1.2/riaxe-product-designer.php#L3150
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/tags/2.1.2/riaxe-product-designer.php#L4271
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/trunk/riaxe-product-designer.php#L2993
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/trunk/riaxe-product-designer.php#L3150
• https://plugins.trac.wordpress.org/browser/riaxe-product-customizer/trunk/riaxe-product-designer.php#L4271
• https://www.wordfence.com/threat-intel/vulnerabilities/id/59da92e2-9ea0-4566-ae4d-3d5d91d0e42e?source=cve

Published

Apr 16, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35905T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, an…9.8
• CVE-2026-35906An undocumented debug CGI endpoint in T3 Technology CPE mode…9.6
• CVE-2026-3591A use-after-return vulnerability exists in the `named` serve…5.4
• CVE-2026-3592BIND resolvers are vulnerable to an amplified resource consu…5.3
• CVE-2026-3593A use-after-free vulnerability exists within the DNS-over-HT…9.8
• CVE-2026-3594The Riaxe Product Customizer plugin for WordPress is vulnera…5.3
• CVE-2026-3596The Riaxe Product Customizer plugin for WordPress is vulnera…9.8
• CVE-2026-3598Use of a Broken or Risky Cryptographic Algorithm vulnerabili…7.5
• CVE-2026-3599The Riaxe Product Customizer plugin for WordPress is vulnera…7.5
• CVE-2026-3600The Investi plugin for WordPress is vulnerable to Stored Cro…6.4
• CVE-2026-3601The User Registration & Membership plugin for WordPress is v…4.3
• CVE-2026-3602IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12…5.5