The Riaxe Product Customizer plugin for WordPress contains an unauthenticated endpoint that returns sensitive WooCommerce order data. The '/wp-json/InkXEProductDesignerLite/orders' API endpoint is registered with a 'permission_callback' set to '__return_true', which effectively bypasses any authentication or authorization checks. As a result, any user—without credentials—can retrieve customer first and last names, customer IDs, order IDs, totals, dates, currencies, and statuses, exposing confidential purchase information.

WordPress sites that have the Riaxe Product Customizer plugin installed and running a version up to and including 2.4 are affected. The vulnerability applies to all such installations regardless of theme or other plugins.

With a CVSS base score of 5.3, the issue presents moderate severity, but the lack of authentication makes exploitation trivial for remote attackers. No EPSS score is available to gauge current exploitation rate, and the vulnerability is not listed in the CISA KEV. It poses a significant risk of exposing customer data, especially on high‑traffic stores, and can lead to privacy breaches or financial fraud if attackers later misuse the data.