CVE-2026-7638 is an insecure direct object reference vulnerability (CWE-639) in the App Builder – Create Native Android & iOS Apps On The Flight WordPress plugin. The vulnerability arises because the upload_avatar() function accepts a user_id parameter from the POST request body without verifying that the authenticated user has permission to modify the specified user account. This lack of authorization validation enables authenticated attackers with at least Subscriber privileges to overwrite profile avatars of arbitrary users by targeting the /wp-json/app-builder/v1/upload-avatar REST API endpoint.

The vulnerability allows authenticated users with Subscriber-level access or higher to modify profile avatars of any user on the WordPress site, including administrators. While this does not directly disclose sensitive information or allow privilege escalation, it can be used to manipulate user profiles, potentially aiding social engineering or phishing attacks by impersonating administrators or other users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint to trusted users only or disable the plugin if possible. Monitor for updates from the vendor and apply patches promptly once released.