The MStore API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.18.3. This is due to the updateuserprofile() function in controllers/flutter-user.php processing the 'metadata' JSON parameter without any allowlist, blocklist, or validation of meta keys. The function reads raw JSON from php://input (line 1012), decodes it (line 1013), authenticates the user via cookie validation (line 1015), and then directly iterates over the user-supplied metadata array passing arbitrary keys and values to updateusermeta() (line 1080) with no sanitization or restrictions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary user meta fields on their own accounts, including sensitive fields like wpuserlevel (to escalate to administrator-level legacy checks), plugin-specific authorization flags (e.g., wpufuseractive, aiowpsaccountstatus), and billing/profile fields with unsanitized values (potentially enabling Stored XSS in admin contexts). Note that wpcapabilities cannot be directly exploited this way because it requires a serialized array value, but wpuserlevel (a simple integer) and numerous plugin-specific meta keys are exploitable.