This vulnerability in Webkul Bagisto up to version 2.4.4 involves an authorization bypass in the Admin Customer Impersonation Feature. An attacker can remotely manipulate the ID argument in the /admin/customers/login-as-customer/ component to bypass authorization checks. The vendor has confirmed prior internal identification of this issue and is actively addressing it through their development lifecycle, with partial fixes already applied and remaining fixes planned for upcoming releases. The CVSS 4.0 score is 5.1, indicating medium severity. No official patch or remediation level has been published yet, and no known active exploitation is reported.

Successful exploitation allows an attacker with some level of privileges (high privileges required as per CVSS vector) to bypass authorization controls in the customer impersonation feature. This could lead to unauthorized access to customer accounts or actions performed on behalf of customers. The impact is limited by the requirement for high privileges and the vulnerability's low to medium impact on confidentiality, integrity, and availability as indicated by the CVSS vector.

The vendor has acknowledged the vulnerability and is addressing it through their internal security and development lifecycle. Some fixes have already been implemented, with remaining issues planned for resolution in upcoming product releases. No official patch or workaround is currently published. Users should monitor vendor communications for updates and apply patches once they become available. Until then, restrict access to the affected feature to trusted administrators only.