What the vulnerability does
01Description
The Riaxe Product Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.2. This is due to the plugin registering a REST API route at POST /wp-json/InkXEProductDesignerLite/customer/delete_customer without a permission_callback, causing WordPress to default to allowing unauthenticated access, and the inkxe_delete_customer() callback function taking an array of user IDs from the request body and passing each one directly to wp_delete_user() without any authentication or authorization checks. This makes it possible for unauthenticated attackers to delete arbitrary WordPress user accounts, including administrator accounts, leading to complete site lockout and data loss.
Explanation of Vulnerability in Simple Terms
02Summary
The Riaxe Product Customizer through version 2.1.2 lacks proper authorization checks, allowing unauthenticated attackers to modify data via the network. No authentication or user interaction is required to exploit this vulnerability. Site administrators should update to a version newer than 2.1.2 to prevent unauthorized modifications.
What an attacker can do
03Attacker Capabilities
Modify product customizer data without authentication.
Potential impact on your site
04Site Impact
Attackers can alter product customization settings, potentially affecting customer orders or site functionality.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
April 16, 2026
CVE published
April 16, 2026
Record updated
