The Riaxe Product Customizer plugin registers a REST API route at POST /wp-json/InkXEProductDesignerLite/customer/delete_customer without a permission_callback. This default to unauthenticated access. The callback accepts an array of user IDs, then passes each directly to wp_delete_user(), allowing an attacker to delete any WordPress user, including administrators, without authentication. The result can be complete site lockout and data loss.

All WordPress installations that have imprintnext Riaxe Product Customizer version 2.1.2 or earlier installed are affected. The vulnerability exists in the plugin code itself; any site that relies on this plugin for product customization is at risk.

The CVSS score of 5.3 indicates a medium severity risk. EPSS data is not available and the vulnerability has not been listed in CISA’s KEV catalog, suggesting no current widespread exploitation. The attack vector is deduced to be an unauthenticated HTTP POST request to the exposed REST endpoint; no credentials or privilege escalation are required for exploitation.