A critical SQL injection vulnerability in the Riaxe Product Customizer plugin allows unauthenticated remote attackers to compromise sensitive database contents.

The plugin fails to properly sanitize user-supplied input within the options parameter keys of the add-item-to-cart REST API endpoint. This allows unauthenticated attackers to perform SQL injection attacks by appending malicious queries to existing database commands.

Successful exploitation of this vulnerability permits unauthorized access to sensitive information stored within the WordPress database. Given the CVSS score of 7.5, this high-severity flaw poses significant risks to data confidentiality, potentially leading to the exposure of user credentials, personal data, or proprietary business configuration details.

Immediate Action: Since no patched version is currently available, administrators should immediately deactivate and remove the Riaxe Product Customizer plugin from all WordPress installations until a vendor-supplied update is released.

Proactive Monitoring: Security teams should review web server access logs for suspicious requests directed at the /wp-json/InkXEProductDesignerLite/add-item-to-cart endpoint, specifically looking for SQL syntax patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection payloads and restrict access to the affected REST API endpoint to authorized network ranges if deactivation is not immediately feasible.

Public Exploit Available: Unknown

The severity of this vulnerability is elevated by the fact that it requires no authentication to trigger. Organizations should prioritize the removal of the affected plugin immediately to prevent potential data breaches. Continue to monitor official vendor channels for the release of a security patch and perform a thorough audit of the database if the site remained active while the vulnerable plugin was installed.