Horizon Alert
Summary of the vulnerability and why it matters
An unauthenticated vulnerability in the WordPress Riaxe Product Customizer plugin allows unauthorized users to modify critical site settings. This can lead to an attacker gaining administrative privileges on the affected website.
- Attackers can take full control.
- Any internet-connected site using the plugin is at risk.
- This could impact business operations and data.
Attack Path
How an attacker could exploit the issue
Unauthenticated attackers can exploit this flaw by sending specially crafted AJAX requests to a WordPress site. The vulnerable plugin's `install-imprint` AJAX action allows an attacker to directly manipulate WordPress options without checks. This can be used to elevate their privileges to administrator, gaining full control of the website.
- Unauthenticated access is sufficient.
- AJAX action `wp_ajax_nopriv_install-imprint`.
- Target: Modify WordPress options.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability in the Riaxe Product Customizer plugin allows unauthenticated attackers to update arbitrary WordPress options, leading to privilege escalation. The lack of authentication, capability checks, or option name validation on the `ink_pd_add_option()` function makes exploitation straightforward. Attackers could leverage this to enable user registration and assign administrator privileges to any user, gaining full control of a WordPress site.
- Unauthenticated remote code execution path.
- No public exploits observed.
- Plugin actively used by many WordPress sites.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Given this is a critical, unauthenticated privilege escalation vulnerability in the Riaxe Product Customizer plugin, prioritize isolating or taking offline all affected WordPress instances. Monitor for signs of unauthorized option changes or user role modifications, as attackers can exploit this to gain administrator access. If immediate downtime is not feasible, implement strict firewall rules to block access to the vulnerable AJAX endpoint and consider disabling the plugin temporarily.
- Block unauthenticated AJAX requests.
- Isolate affected WordPress instances.
- Update plugin to version 2.1.3 or later.
