This vulnerability affects Webkul Bagisto versions up to 2.4.4 in the Backend Customer Behavior Data Endpoint, specifically in the /admin/customers file. Improper handling of the ID argument leads to improper privilege management, allowing remote attackers to potentially escalate privileges. The vendor has identified and is addressing the issue through their internal security processes, with partial fixes already applied and further resolutions planned in future releases. The CVSS 3.1 score is 5.3 (medium severity), indicating a network attack vector with low complexity and no user interaction required.

An attacker can remotely exploit this vulnerability to manipulate privilege levels improperly, potentially gaining unauthorized access or elevated privileges within the Bagisto backend customer management interface. This could lead to unauthorized data access or administrative actions. However, the impact is rated medium severity and no active exploitation in the wild is currently known.

The vendor has confirmed that some fixes have already been implemented internally and that remaining issues are planned for resolution in upcoming product releases. No official patch or update is publicly available at this time. Users should monitor vendor communications for official updates and apply patches once released. Until then, consider restricting access to the /admin/customers endpoint to trusted administrators only.