A flaw in the Scheduled Task Endpoint file Crontab.php within ShopXO leads to an unauthorized privilege escalation that allows a remote actor to invoke backend operations such as OrderClose, OrderSuccess, PayLogOrderClose and GoodsGiveIntegral. The defect permits the bypass of legitimate authentication checks, effectively letting attackers execute these functions without credential verification. In practice this could enable denial of service, monetary loss or manipulation of reward points for users.

ShopXO is affected, versions up to and including 6.7.1 possess the vulnerability. Any deployment of these releases that retains the exposed Crontab.php endpoint is vulnerable.

The CVSS score of 6.9 indicates a moderate to high severity. No EPSS score is available, but the issue has been publicly disclosed and can be leveraged remotely, so an attacker with network access could exploit it. The vulnerability is not present in the CISA KEV catalog, but the lack of vendor response suggests a critical risk for administrators who have not yet patched or mitigated.