The vulnerability is an Insecure Direct Object Reference (IDOR) in the AddressController component of the waynboot-mall mobile API. Authenticated users are able to alter or delete shipping addresses belonging to other members by using the POST /address and DELETE /address/{addressId} endpoints. This flaw allows the attacker to replace valid addresses with their own or delete addresses entirely, potentially redirecting shipments, causing loss of goods, or compromising member privacy. The vulnerability is classified as a moderate severity issue with a CVSS score of 5.3, indicating that while it does not provide arbitrary code execution, it represents a significant integrity and privacy risk.

The flaw affects waynboot-mall version 2.0.0, developed by wayn111. No other versions are listed as impacted, and the vulnerability appears specific to this release of the mobile AddressController.

Because the attack requires authenticated access, an attacker must first log in before enumerating auto‑incrementing address identifiers and sending the POST or DELETE requests. No exploitation code has been reported, and the vulnerability is not currently listed in the CISA Key Exploited Vulnerabilities (KEV) catalog. The lack of an EPSS score makes it unclear how frequently the flaw is actively exploited, but the moderate CVSS rating and the ability to alter or delete other users' addresses indicates that the risk warrants mitigation. Implementing ownership checks or updating to a patched release is the appropriate response.