The REST API TO MiniProgram plugin for WordPress contains an Insecure Direct Object Reference flaw. The permission check verifies only that the supplied ‘openid’ belongs to an existing user, but the subsequent update routine uses an independent, attacker‑controlled ‘userid’ parameter to identify which user's metadata will be altered. Consequently, an authenticated attacker with Subscriber level access or higher can change the store‑related metadata (storeinfo, storeappid, storename) of any user on the site. This constitutes an integrity violation that could mislead customers or partners who rely on accurate store information.

This vulnerability affects all releases of the xjb REST API TO MiniProgram plugin up to and including version 5.1.2. Any WordPress installation deploying the plugin within that version range is susceptible. Versions 5.1.3 and later have removed the problematic separation of validation logic.

The CVSS v3.1 score of 5.3 classifies the issue as moderate. Exploitation requires only that the attacker be a registered WordPress user with the Subscriber role or higher, which is commonly available on many sites. The attack vector is authenticated, with no remote code execution gain; the main risk is unauthorized alteration of user data. The vulnerability is not listed in CISA’s KEV catalog, and no EPSS score is available, so the precise likelihood of exploitation cannot be quantified. Nonetheless, the potential for silent data tampering warrants prompt remediation.