A flaw in MacCMS up to 2025.1000.4052 allows remote manipulation of the order_id argument in the order_info function of User.php, leading to an unauthorized bypass of access checks. This weakness permits an attacker to view or modify order details that should be protected by authentication, effectively exposing confidential customer data. The vulnerability is rooted in improper authorization checks, as identified by CWE-285 and CWE-639.

MacCMS versions released before or equal to 2025.1000.4052 are affected. The attack targets the Member Order Detail Interface component, specifically the User.php controller handling order information. No other affected products or versions are listed.

The CVSS base score of 5.3 indicates moderate severity. The exploit is available publicly and can be invoked remotely, increasing its risk floor. While the EPSS score is not available, the lack of KEV listing suggests the vulnerability has not yet been catalogued as a widely exploited weakness. Attackers would need remote access to the application and can supply crafted order_id parameters to bypass authorization checks, making the exploitation straightforward for those with network reach to the system.