A missing authentication check allows an unauthenticated attacker to invoke the internal /callback/order/submit endpoint. By supplying arbitrary userId, addressId and cart identifiers in the order JSON, the attacker can create orders for any member, reveal stored shipping information, clear carts, and decrement inventory stock. This flaw enables unauthorized transactions, data leakage, and inventory manipulation without the need for valid credentials.

The vulnerability affects the waynboot-mall application by wayn111, version 2.0.0 and earlier. No specific subcomponents are listed beyond the mobile API and order service modules identified in the source code references.

The CVSS score of 6.9 indicates a medium severity vulnerability. EPSS is unavailable, so exact exploitation probability cannot be quantified, and the issue is not listed in the CISA KEV catalog. The likely attack vector is a remote unauthenticated HTTP request to the internal callback endpoint, which may be reachable from the public internet or through an exposed internal network. Once accessed, an attacker can forge orders and manipulate sensitive data.