The App Builder plugin for WordPress up to version 5.6.0 has an Insecure Direct Object Reference (IDOR) vulnerability in the upload_avatar() function. This flaw allows authenticated users with Subscriber-level access or higher to overwrite the profile avatar of any user, including administrators, by specifying an arbitrary user_id in a POST request to the /wp-json/app-builder/v1/upload-avatar endpoint. The vulnerability arises from missing authorization checks on the user_id parameter.