The flaw occurs in the Stripe Plugin's StripeController.php callback within Chengdu Everbrite's BeikeShop up to 1.6.0.22. An attacker can manipulate the request argument sent to the callback endpoint, which bypasses the intended authorization checks. This allows an unauthenticated or unauthorized user to trigger actions that should otherwise be protected, potentially resulting in unauthorized access to sensitive data or undesired financial actions. The weakness is classified as an improper authorization flaw (CWE‑266/285).

Chengdu Everbrite Network Technology publishes the BeikeShop e‑commerce platform. The vulnerability affects all versions of the platform up to and including 1.6.0.22 that use the Stripe Plugin. The specific component is the StripeController.php file within the plugin. Users running the affected releases should review the patch commit 6719e0fc690ea0a998452092862e0f0a17c65968 for remediation.

The CVSS score of 6.9 places the vulnerability in the medium severity range. No EPSS value is available, but the vulnerability is publicly advertised and can be exploited remotely through the exposed callback endpoint. The issue is not listed in the CISA KEV catalog, but its public exploitation potential and lack of mitigations means that organizations should treat it as a moderate risk that can lead to unauthorized data or transaction compromise. The attack vector is likely remote, requiring only the ability to send a crafted request to the callback URL.