This issue allows a malicious customer to change the order address without triggering address validations, potentially altering shipment costs. All stores with at least two shipping zones and different costs of shipment per zone are impacted. The problem stems from the structure of checkout permitted attributes, which are applied across the whole checkout process.