CVE-2026-3460 is an improper input validation vulnerability in the xjb REST API TO MiniProgram WordPress plugin. The issue arises because the permission callback validates the 'openid' parameter to ensure it belongs to an existing user, but the update function uses a separate 'userid' parameter to identify which user's metadata to modify. There is no verification that the 'openid' and 'userid' correspond to the same user, enabling authenticated attackers with Subscriber-level access or higher to modify store-related metadata (storeinfo, storeappid, storename) of arbitrary users via the REST API. This vulnerability affects all versions up to and including 5.1.2. The CVSS 3.1 base score is 5.3, indicating medium severity. No patch or remediation details are provided in the available data.

Authenticated users with Subscriber-level access or higher can modify arbitrary users' store-related metadata, potentially leading to unauthorized changes in user data related to the MiniProgram store. There is no indication of confidentiality or availability impact, only integrity is affected. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the REST API TO MiniProgram plugin to trusted users only and monitor for suspicious activity related to user metadata changes. Avoid granting Subscriber-level or higher access to untrusted users. Follow vendor updates for official patches or fixes.