The vulnerability is an Insecure Direct Object Reference in the UserAddressController that permits any authenticated member to enumerate, view, edit, or delete the shipping addresses of other members. This enables the exposure of recipient names, phone numbers, and physical addresses, as well as the ability to reassign or remove those addresses. The weakness is identified as CWE‑639 and grants attackers the potential to read, overwrite, and delete sensitive personal data.

Products: Yshopmall by guchengwuyue, version 2.0.0 and any earlier releases. The known affected version is up to 2.0.0; no patch or fix version is provided in the CNA data.

The CVSS score of 7.1 indicates a high severity for potential impacts on confidentiality, integrity, and availability for authentication-enabled users. The EPSS score is not available, so the likelihood of exploitation cannot be quantified; however, the attack requires only an authenticated session and can enumerate addresses via predictable ID patterns. The vulnerability is not currently in the CISA KEV catalog, so no known active exploitation is reported, but the existence of a straightforward enumeration method raises concern for opportunistic exploitation.