The vulnerability identified as CVE-2025-58201 affects AfterShip Tracking plugin versions up to 1.17.17. It is caused by missing authorization checks, which permit unauthenticated users to access certain functions that should be restricted by ACLs. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, with no confidentiality or availability impact but with a potential integrity impact. No patch or vendor advisory is currently provided, and the product is not a cloud service, so remediation depends on vendor updates.

The vulnerability allows unauthorized users to perform actions that should be restricted, potentially leading to unauthorized modification or manipulation of data (integrity impact). There is no impact on confidentiality or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from AfterShip & Automizely and consider restricting access to the plugin functionality where possible.