The vulnerability allows an authenticated user with Subscriber or higher privileges to modify any user’s avatar by sending a manipulated user_id parameter to the plugin’s upload-avatar endpoint. This creates a potential for account impersonation, phishing attacks, or defacement of administrator profiles, compromising the integrity of user identities. The flaw arises from a missing authorization check in the upload_avatar function, which updates user meta based solely on the supplied user_id.

Apps created with Appcheap’s App Builder – Create Native Android & iOS Apps On The Flight WordPress plugin, all versions up to and including 5.6.0, are affected. The issue is present in the core code where avatar uploads are processed.

The CVSS score of 5.3 indicates moderate severity, and the exploitability depends on the attacker’s credentials; the EPSS score is not available and the vulnerability is not catalogued in KEV. Attackers must be authenticated as a Subscriber or higher, then issue a POST request to the /wp-json/app-builder/v1/upload-avatar route with a crafted user_id. No additional privileges or system wide access are required beyond these credentials. Because the attack vector is limited to logged-in users, the practical risk is moderated but still significant for sites with many subscriber users.