The MStore API plugin is vulnerable to an insecure direct object reference that allows authenticated users with Subscriber level or higher to supply arbitrary meta keys and values into the user profile update endpoint. This flaw is derived from the update_user_profile() function, which decodes untrusted JSON from php://input and passes it directly to update_user_meta() without any validation. As a result, attackers can set sensitive fields such as wp_user_level, plugin authorization flags, and billing details, leading to possible privilege escalation and stored cross‑site scripting in the admin interface.

All installations of the MStore API plugin for WordPress with versions 4.18.3 or earlier are affected. The plugin is developed by inspireui under the name 'MStore API – Create Native Android & iOS Apps On The Cloud'. No additional version ranges are specified beyond the stated upper limit.

The reported CVSS score of 4.3 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to be authenticated (e.g., a logged‑in Subscriber or higher) and to supply crafted JSON in the request body. The lack of input filtering makes exploitation straightforward once authentication is achieved, but it does not allow arbitrary code execution. The risk is therefore moderate, with the primary impact being privilege escalation and potential XSS. The likelihood of exploitation is limited to environments where the plugin is active and vulnerable.