CVE-2026-3596

OVERVIEW The Riaxe Product Customizer plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to and including 2.1.2. An unauthenticated AJAX action fails to properly validate user input or verify authorization, allowing attackers to arbitrarily modify WordPress options through the unprotected 'wp_ajax_nopriv_install-imprint' function. SEVERITY This vulnerability carries a CVSS 3.1 score of 9.8 CRITICAL with a network-based attack vector requiring no authentication, low complexity, and no user interaction. The impact is severe across all three security dimensions: attackers can read sensitive data, modify system configurations, and disrupt service availability. Most critically, this can be exploited to enable user registration and assign administrator privileges to attacker-controlled accounts, resulting in complete compromise of the WordPress installation. EXPLOITATION STATUS The vulnerability is currently not listed on CISA's Known Exploited Vulnerabilities catalog and has not achieved attention as a hot-list item. However, the exploitation barrier is extremely low given the straightforward AJAX manipulation required. Organizations running affected versions should treat this as high priority for immediate patching, as the simplicity of exploitation and severity of impact make weaponization a realistic threat despite current low early exploitation metrics.