This vulnerability in Webkul Bagisto up to version 2.4.4 involves improper authorization checks in the Backend Sales RMA Endpoint, specifically in handling requests to /admin/sales/rma/requests. An attacker with high privileges can manipulate requests to bypass authorization mechanisms remotely. The vendor has identified these issues through internal security assessments and is addressing them through their development lifecycle, with some fixes already applied and others planned for upcoming releases. No official patch or remediation level has been publicly disclosed yet.

Successful exploitation allows an attacker with high privileges to bypass authorization controls on the Backend Sales RMA Endpoint, potentially enabling unauthorized actions related to sales return merchandise authorization (RMA) requests. This could lead to unauthorized access or modification of RMA data. The vulnerability is exploitable remotely and an exploit has been publicly released, increasing the risk of attacks. However, there is no indication of active exploitation in the wild at this time.

The vendor has confirmed that some fixes have already been implemented internally and additional fixes are planned for future releases. No official patch or workaround is currently publicly available. Users should monitor vendor communications for upcoming security updates and apply them promptly once released. Until then, restrict access to the affected endpoint to trusted administrators only and apply principle of least privilege to limit potential impact.