Critical WordPress Plugin Flaw: Riaxe Product Customizer Privilege Escalation

The National Vulnerability Database (NVD) has flagged a critical privilege escalation vulnerability, CVE-2026-3596, impacting the Riaxe Product Customizer plugin for WordPress. This flaw affects all versions up to, and including, 2.1.2, earning a severe CVSS score of 9.8 (CRITICAL).

According to the NVD, the plugin registers an unauthenticated AJAX action, wp_ajax_nopriv_install-imprint, which maps directly to the ink_pd_add_option() function. The real kicker here is that this function reads option and opt_value directly from $_POST and then proceeds to call delete_option() followed by add_option() using these attacker-controlled values. Crucially, there’s no nonce verification, capability checks, or even a basic option name allowlist in place. This glaring oversight means an unauthenticated attacker can effectively update arbitrary WordPress options. The implications are dire: an attacker could enable user registration and then set the default user role to administrator, effectively handing over the keys to the kingdom.