Technical impact
The Riaxe Product Customizer plugin for WordPress contains an unauthenticated AJAX endpoint that lets any website visitor call a function that executes delete_option and add_option on arbitrary option names supplied by the attacker. Because the code performs no nonce verification, capability checks, or option name allowlist, an unauthenticated attacker can change WordPress configuration options. By setting the default role for new users to administrator or enabling registration, an attacker can effectively elevate privileges and seize control of the site.
Affected Systems
The vulnerability affects the Imprintnext Riaxe Product Customizer WordPress plugin, versions 2.1.2 and earlier.
Risk and Exploitability
The CVSS base score of 9.8 indicates critical severity. With no EPSS data available, the exploit probability is uncertain, but the absence of authentication checks means the vulnerability is highly actionable in practice. An attacker only needs to send an unauthenticated HTTP POST to the 'install-imprint' AJAX action, which is widely available on any site running the affected plugin, making the attack straightforward and the risk of exploitation significant.
