This vulnerability affects macrozheng mall versions 1.0.0 through 1.0.3 in the Super Admin Password Handler component, specifically in the /admin/update/ file. It results from improper authorization, allowing an attacker with high privileges to perform unauthorized actions remotely. The CVSS 4.0 base score is 5.1 (medium severity), indicating network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts. The vendor has not provided a fix or response, and no known exploits are reported in the wild.

The vulnerability allows remote attackers with high privileges to bypass proper authorization controls in the Super Admin Password Handler, potentially leading to unauthorized administrative actions. The impact is limited to confidentiality, integrity, and availability with low severity, but it could facilitate further compromise if exploited. No evidence of active exploitation is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the vendor or community. Restricting access to the /admin/update/ endpoint and enforcing strict access controls may help mitigate risk until a patch is released.