This vulnerability affects Webkul Bagisto versions 2.4.0 to 2.4.4 and involves manipulation of the rma_qty, resolution_type, and rma_reason_id arguments in the /customer/account/rma/store file. Exploiting this flaw results in enforcement of behavioral workflow, though the exact impact of this enforcement is not detailed. The attack can be performed remotely without requiring user interaction or privileges beyond low-level privileges. The vendor has confirmed prior knowledge of the issue and is actively working on fixes, some of which have been implemented, with remaining fixes planned for upcoming releases. No official patch or remediation level is currently published.

The vulnerability allows remote attackers with low privileges to manipulate certain request arguments, causing enforcement of behavioral workflow in the affected component. The exact consequences of this enforcement are unspecified, but it may affect the normal operation of the RMA (Return Merchandise Authorization) process. There is no evidence of active exploitation in the wild at this time.

The vendor has acknowledged the vulnerability and is addressing it through their internal security and development lifecycle. Some fixes have already been applied, and additional resolutions are planned for future product releases. No official patch or workaround is currently available. Users should monitor vendor communications for updates and apply patches once released.