This vulnerability in ShopXO up to version 6.7.1 involves an authorization bypass in the Scheduled Task Endpoint component, impacting the functions OrderClose, OrderSuccess, PayLogOrderClose, and GoodsGiveIntegral within app/api/controller/Crontab.php. Remote attackers can exploit this flaw to bypass authorization mechanisms, potentially allowing unauthorized actions related to order and payment processes. The vulnerability is publicly disclosed, but no vendor response or patch is available at this time.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to bypass authorization checks in critical order and payment-related functions. This could lead to unauthorized order closures, payment log manipulations, or unauthorized granting of integral goods points. The exact impact depends on how these functions are used within the ShopXO environment, but it poses a risk to the integrity of order processing and related business logic.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch is available, users should monitor for vendor updates. Until a fix is released, consider implementing additional access controls or network-level restrictions to limit access to the affected Scheduled Task Endpoint if possible.