This vulnerability in AfterShip Tracking plugin (<= 1.17.17) arises from missing authorization checks, permitting unauthorized users to access certain functions that should be protected by ACLs. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but low integrity impact. The issue is documented but no patch or mitigation guidance is currently provided by the vendor. It is not a cloud service, so remediation depends on plugin updates.

The vulnerability allows unauthorized users to perform actions that should be restricted, potentially leading to integrity violations within the affected plugin. There is no impact on confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting access to the plugin's administrative functions and monitor for updates from AfterShip & Automizely. No official fix or temporary workaround is currently documented.