CVE-2026-3599: 
WordPress vulnerability analysis and mitigation

CVE-2026-3599 is a SQL Injection vulnerability in the Riaxe Product Customizer (InkXE Product Designer Lite) plugin for WordPress, affecting all versions up to and including 2.1.2. The flaw resides in the /wp-json/InkXEProductDesignerLite/add-item-to-cart REST API endpoint, where the options parameter keys within product_data are insufficiently escaped and improperly prepared before being used in SQL queries. It was disclosed on April 16, 2026, with Wordfence as the CNA. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Wordfence Advisory, GitHub Advisory).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), stemming from insufficient escaping of user-supplied input and inadequate SQL query preparation in the plugin's riaxe-product-designer.php file (notably around lines 3576, 6808, and 6876). An unauthenticated attacker can send a crafted HTTP request to the publicly accessible REST API endpoint, injecting malicious SQL clauses via the options parameter keys within the product_data JSON body. No authentication, privileges, or user interaction are required, making this a low-complexity, network-exploitable attack (Wordfence Advisory, Plugin Source).

Successful exploitation allows unauthenticated remote attackers to append arbitrary SQL queries to existing database operations, enabling extraction of sensitive information from the WordPress database. This includes WordPress user credentials (hashed passwords, email addresses), personal data, WooCommerce order details, and other confidential database contents. The impact is limited to confidentiality (rated High); there is no direct integrity or availability impact from this vulnerability alone, though extracted credentials could enable further account takeover and lateral movement (Wordfence Advisory, GitHub Advisory).

As of the time of disclosure, there is no confirmed public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.039–0.055%, placing it in the lower percentiles for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, a Nuclei detection template pull request was submitted to ProjectDiscovery's nuclei-templates repository, indicating community interest in automated scanning for this flaw (Nuclei Templates PR).

1. Reconnaissance: Identify WordPress sites running the Riaxe Product Customizer plugin (version ≤ 2.1.2) using tools like WPScan, Shodan, or by checking /wp-content/plugins/riaxe-product-customizer/ for plugin presence.
2. Confirm endpoint availability: Send a baseline HTTP POST request to /wp-json/InkXEProductDesignerLite/add-item-to-cart to confirm the REST API endpoint is accessible without authentication.
3. Craft malicious payload: Construct a JSON body with the product_data field containing an options parameter whose keys include SQL injection payloads (e.g., appending UNION SELECT or time-based blind injection clauses such as ' AND SLEEP(5)--).
4. Inject and extract data: Submit the crafted request and observe the response or timing to confirm injection. Use tools like sqlmap targeting the vulnerable parameter to automate extraction of database contents, including the wp_users table for credentials.
5. Exfiltrate sensitive data: Retrieve hashed passwords, email addresses, and other sensitive records from the database for offline cracking or further exploitation (Wordfence Advisory, Plugin Source).

• Network: Unusual or repeated HTTP POST requests to /wp-json/InkXEProductDesignerLite/add-item-to-cart from a single IP or automated tooling; requests containing SQL keywords (e.g., UNION, SELECT, SLEEP, BENCHMARK, --) in the product_data body.
• Logs: WordPress/web server access logs showing high-frequency or anomalous requests to the above REST API endpoint; database error logs indicating malformed SQL queries or unexpected query structures.
• Database: Unexpected or unauthorized queries against wp_users, wp_usermeta, or other sensitive tables originating from the WordPress application process; evidence of UNION SELECT or time-delay functions in slow query logs.

The primary remediation is to update the Riaxe Product Customizer plugin to a version newer than 2.1.2, which addresses the insufficient escaping and SQL query preparation issues (Wordfence Advisory). If immediate patching is not feasible, site administrators should consider temporarily disabling the plugin or blocking access to the /wp-json/InkXEProductDesignerLite/add-item-to-cart endpoint via a Web Application Firewall (WAF) or server-level access controls. Additionally, monitoring database activity for suspicious SQL queries and reviewing access logs for unauthorized extraction attempts is recommended as a compensating control.

Wordfence included CVE-2026-3599 in their weekly WordPress vulnerability report for the period of April 13–19, 2026, highlighting it as part of their ongoing threat intelligence coverage (Wordfence Blog). A pull request was submitted to the ProjectDiscovery nuclei-templates repository to add automated detection for this vulnerability, reflecting community interest in scanning for affected installations (Nuclei Templates PR). General community reaction has been limited, consistent with the absence of active exploitation or a public PoC.