CVE-2026-3596
Published: 16 April 2026
Summary
CVE-2026-3596 is a critical-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-3596 is a privilege escalation vulnerability affecting the Riaxe Product Customizer plugin for WordPress in all versions up to and including 2.1.2. The issue stems from an unauthenticated AJAX action, 'wp_ajax_nopriv_install-imprint', which maps to the ink_pd_add_option() function. This function directly reads 'option' and 'opt_value' parameters from $_POST data and uses them to invoke delete_option() followed by add_option() without any nonce verification, capability checks, or allowlisting of option names. Published on 2026-04-16, the vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-862 (Missing Authorization).
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By sending a crafted POST request to the vulnerable AJAX endpoint, attackers can update arbitrary WordPress options. This capability enables privilege escalation, such as enabling user registration via the 'users_can_register' option and setting the default user role to administrator through 'default_role', allowing attackers to create admin accounts upon registration.
References provided link to specific lines in the plugin's source code at version 2.1.2 (riaxe-product-designer.php), including lines 183, 5045-5047, and 5058, which illustrate the direct use of unvalidated $_POST inputs in option modification functions without security controls. No patch or mitigation details are specified in the available information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23184
Vulnerability details
The Riaxe Product Customizer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.2. The plugin registers an unauthenticated AJAX action ('wp_ajax_nopriv_install-imprint') that maps to the ink_pd_add_option() function. This function reads 'option' and 'opt_value'…
more
from $_POST, then calls delete_option() followed by add_option() using these attacker-controlled values without any nonce verification, capability checks, or option name allowlist. This makes it possible for unauthenticated attackers to update arbitrary WordPress options, which can be leveraged for privilege escalation by enabling user registration and setting the default user role to administrator.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unauthenticated remote vulnerability in a public-facing WordPress plugin directly enables T1190 (Exploit Public-Facing Application) and results in T1068 (Exploitation for Privilege Escalation) by allowing arbitrary option modification to create admin accounts.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the flaw in the ink_pd_add_option() function by applying patches that add nonce verification, capability checks, and option allowlisting to prevent unauthenticated arbitrary option updates.
Enforces authorization and access control policies on the unauthenticated AJAX endpoint to block privilege escalation via unauthorized WordPress option modifications.
Validates 'option' and 'opt_value' parameters from $_POST data to reject arbitrary inputs that enable enabling user registration and setting administrator default roles.