The flaw, which existed in a Shopify API endpoint, has been patched.
Source: Threadpost