This vulnerability affects the Stripe plugin component of BeikeShop up to version 1.6.0.22. Specifically, the callback function in plugins/Stripe/Controllers/StripeController.php improperly authorizes requests when the Request argument is manipulated. This allows an unauthenticated remote attacker to bypass authorization controls. Although a patch commit hash is referenced, no explicit vendor advisory or remediation level is provided. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability.

An attacker can remotely exploit this vulnerability to bypass authorization controls in the Stripe plugin callback function, potentially allowing unauthorized actions within the affected component. The impact is rated medium based on the CVSS score of 6.9, reflecting limited but meaningful compromise potential without requiring authentication or user interaction.

A patch identified by the commit hash 6719e0fc690ea0a998452092862e0f0a17c65968 is suggested to address this issue. However, no official vendor advisory or remediation level is provided to confirm patch availability or deployment status. Users should verify with the vendor or official sources for the patch and apply it promptly to mitigate the vulnerability. Until confirmed, patch status remains unverified.