This vulnerability affects Webkul Bagisto versions up to 2.4.4 and concerns an unknown function in the /customer/account/rma/store file. Manipulating the arguments rma_qty, resolution_type, or rma_reason_id can enforce behavioral workflow, potentially altering application behavior. The attack vector is remote with no user interaction required. The vendor has internally identified these issues prior to public disclosure and is addressing them through their development lifecycle, with some fixes already implemented and others forthcoming. The CVSS 3.1 base score is 5.3 (medium severity), indicating a moderate impact with network attack vector, low attack complexity, and low privileges required.

The vulnerability allows remote attackers to manipulate specific parameters in the RMA (Return Merchandise Authorization) workflow, potentially causing unintended enforcement of behavioral workflow logic. The exact impact on confidentiality, integrity, or availability is not detailed, but the CVSS score suggests limited impact with low privileges and no user interaction required. There is no evidence of active exploitation in the wild.

The vendor has confirmed that some issues have already been addressed internally and others are planned for resolution in upcoming product releases. No official patch or update is currently publicly available. Users should monitor vendor advisories for forthcoming updates and apply them once released. Until then, no specific mitigation steps are provided by the vendor.