This vulnerability in Webkul Bagisto up to version 2.4.4 allows an attacker to bypass authorization mechanisms in the backend reporting sales endpoint. The flaw is located in the /admin/reporting/sales/ component, enabling remote exploitation without user interaction or privileges beyond low-level access. The vendor has confirmed prior identification of the issue and is managing remediation internally, with partial fixes already deployed and remaining corrections scheduled for upcoming product versions. No public patch or official fix advisory is currently available.

Successful exploitation of this vulnerability could allow an attacker to bypass authorization controls in the backend reporting sales module, potentially exposing sensitive sales data or administrative functions. The impact is limited by the medium CVSS score and the requirement for at least low privileges, but remote exploitation is possible without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has stated that some fixes have already been applied internally and additional fixes are planned for future releases. Users should monitor official Webkul Bagisto advisories for updates and apply patches once available. Until then, restricting access to the affected backend endpoints and limiting user privileges may reduce exposure.