A flaw in the confirm_logged_in/confirm_user function of the Admin Handler allows an attacker to arbitrarily set the adminid argument, bypassing authorization checks. The vulnerability stems from missing validation of this parameter and is classified as a broken access control weakness (CWE-862, CWE-863). By exploiting this flaw an attacker can gain administrative privileges and perform privileged operations, compromising confidentiality, integrity, and availability of the application.

The affected product is the Abdurrab5 online‑makeup‑store web application. The vulnerable component is the functions.php file within the Admin Handler. No specific version information is available because the application uses a rolling release system.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but public disclosure means the flaw can be exploited remotely by manipulating the adminid parameter in requests. Successful exploitation would enable an attacker to elevate privileges and access sensitive data or configurations.