This vulnerability in ShopXO up to version 6.7.1 allows remote attackers to bypass authorization mechanisms by manipulating specific functions related to scheduled tasks in the Crontab.php controller. The affected functions include OrderClose, OrderSuccess, PayLogOrderClose, and GoodsGiveIntegral. The exploit has been publicly disclosed, but the vendor has not provided a response or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to bypass authorization controls remotely, potentially enabling unauthorized access or actions related to order processing and scheduled tasks within ShopXO. The impact is rated medium, reflecting limited but meaningful compromise potential without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider restricting access to the affected Scheduled Task Endpoint or implementing additional access controls to limit exposure.