Riaxe Product Customizer WordPress Plugin Sensitive Information Exposure Vulnerability

A vulnerability allowing unauthorized access to sensitive information has been identified in the Riaxe Product Customizer plugin for WordPress, affecting all versions through 2.4. The issue arises in the '/wp-json/InkXEProductDesignerLite/orders' REST API endpoint, which is improperly secured with 'permission_callback' set to '__return_true'. This configuration allows unauthenticated users to access WooCommerce order data, including customer names, IDs, order details, totals, dates, currencies, and statuses. As a result, attackers can exploit this vulnerability to extract confidential customer and order information from WooCommerce stores.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive customer and order information from WooCommerce, including personal details and order history.