This vulnerability (CVE-2025-13004) in the Farktor Software E-Commerce Package is classified as CWE-639, which involves authorization bypass through user-controlled keys. An attacker with low privileges and requiring user interaction can manipulate user-controlled variables to bypass authorization controls, potentially impacting the integrity and availability of the system. The vulnerability affects versions through 27112025. The CVSS 3.1 base score is 6.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L), indicating network attack vector, low attack complexity, low privileges required, user interaction needed, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact. No patch or vendor advisory information is currently available.

Successful exploitation allows an attacker with low privileges and user interaction to bypass authorization controls, leading to high integrity impact and low availability impact. Confidentiality is not affected. This could enable unauthorized modification of data or actions within the e-commerce package, potentially disrupting service or corrupting data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is available, users should monitor vendor communications for updates. Until a fix is provided, consider restricting access to the affected versions and applying compensating controls where possible to limit exposure to untrusted users.