CVE-2026-3595 describes an authorization bypass vulnerability (CWE-862) in the Riaxe Product Customizer plugin for WordPress. The vulnerability arises from a REST API route POST /wp-json/InkXEProductDesignerLite/customer/delete_customer that is registered without a permission_callback, defaulting to unauthenticated access. The associated callback function inkxe_delete_customer() accepts an array of user IDs from the request body and calls wp_delete_user() on each without verifying the requester's permissions. This flaw allows unauthenticated attackers to delete arbitrary WordPress user accounts, including administrators, leading to potential site lockout and data loss. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact. No patch or official remediation is currently documented.

An unauthenticated attacker can delete arbitrary WordPress user accounts, including administrator accounts, by exploiting the missing authorization on a REST API endpoint. This can result in complete site lockout and potential data loss due to the removal of critical user accounts. The vulnerability does not impact confidentiality or availability directly but has a low integrity impact by allowing unauthorized user deletions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the REST API endpoint if possible or disable the vulnerable plugin to prevent exploitation. Monitor for updates from the vendor imprintnext regarding an official fix.