The zStore Manager Basic plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the zstore_clear_cache() function. This flaw allows any authenticated user with at least Subscriber privileges to clear the plugin's cache because the function lacks proper capability checks. The vulnerability affects all versions up to 3.311 and could result in unauthorized cache clearing, potentially disrupting normal plugin operation or causing data loss related to cached content.

An attacker with Subscriber-level or higher access can clear the plugin's cache without proper authorization. While this does not lead to direct data confidentiality or availability compromise, it can cause unauthorized loss of cached data, potentially affecting plugin performance or user experience. There is no indication of further privilege escalation or remote unauthenticated exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted individuals only and monitor for suspicious activity related to cache clearing. Avoid granting Subscriber or higher privileges to untrusted users. Follow the vendor's updates for any forthcoming patches or official fixes.