The Riaxe Product Customizer WordPress plugin contains a significant SQL injection flaw. Unauthenticated users can supply crafted input through the 'options' parameter keys in the 'product_data' object of the add-item-to-cart REST endpoint. The plugin fails to properly escape or prepare the SQL query, allowing attackers to inject additional SQL statements and gain unauthorized access to database content. This vulnerability directly compromises confidentiality of sensitive data such as user credentials, orders, and site configuration.

The flaw affects all installations of the imprintnext Riaxe Product Customizer plugin through version 2.1.2. Site owners running any of these versions of the plugin are at risk unless the plugin is updated or otherwise mitigated.

The vulnerability has a CVSS score of 7.5, indicating a high severity. Although the EPSS score is not available, the lack of authentication requirements and the existence of a publicly documented exploitation path mean that attackers can act immediately once a site is discovered. The vulnerability is not currently listed in the CISA KEV catalog, but the potential for widespread exploitation remains high.