CVE-2026-3594 describes a sensitive information exposure vulnerability in the Riaxe Product Customizer WordPress plugin. The REST API endpoint '/wp-json/InkXEProductDesignerLite/orders' is registered with a permission callback that always returns true, effectively bypassing authentication and authorization controls. As a result, unauthenticated attackers can retrieve WooCommerce order data including customer first and last names, customer IDs, order IDs, totals, dates, currencies, and statuses. This exposure affects all versions up to and including 2.4 of the plugin.

An attacker can obtain sensitive customer and order information without any authentication, potentially leading to privacy violations and information disclosure risks. The vulnerability does not allow modification or deletion of data, nor does it impact system availability. The CVSS score of 5.3 reflects a medium severity impact focused on confidentiality loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected REST API endpoint by disabling the plugin or implementing custom access controls to prevent unauthenticated access. Monitor vendor channels for updates and apply patches promptly once released.