This vulnerability affects Webkul Bagisto versions 2.4.0 through 2.4.4 in the RMA State Validation component, specifically the /customer/account/rma/update-status endpoint. The flaw allows an attacker with low privileges to remotely manipulate the behavioral workflow enforcement. The vendor has identified the issue internally and is managing remediation through their development lifecycle, with partial fixes already implemented and additional resolutions planned for upcoming releases. There is no public patch or vendor advisory explicitly confirming remediation status at this time. The CVSS 4.0 base score is 5.3, indicating medium severity.

An attacker with low privileges can remotely manipulate the RMA state validation workflow, potentially causing unintended enforcement of behavioral workflow states. This could disrupt normal RMA processing or workflow logic within the affected application. There is no indication of privilege escalation, data disclosure, or denial of service from the provided information.

The vendor has confirmed that the issues were identified internally and are being addressed through their security and development lifecycle, with some fixes already applied and others planned for future releases. No official patch or workaround has been publicly released yet. Users should monitor vendor communications for updates and apply patches once available. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.