Riaxe Product Customizer Authorization Bypass Vulnerability Allowing Unauthenticated User Deletion

An authorization bypass vulnerability has been identified in the Riaxe Product Customizer plugin for WordPress, affecting all versions through 2.1.2. The vulnerability arises because the plugin registers a REST API route for deleting customers without proper authorization checks. This oversight allows unauthenticated attackers to delete any WordPress user account, including those of administrators, resulting in complete site lockout and potential data loss.

Impact

Exploitation of this vulnerability allows for the unauthorized deletion of WordPress user accounts, including administrators, leading to a complete site lockout and loss of data associated with the deleted accounts.