zStore Manager Basic Missing Authorization Vulnerability in Cache Clearing Function

A vulnerability exists in the zStore Manager Basic plugin for WordPress, affecting all versions through 3.311. The issue arises from a lack of proper capability checks in the zstore_clear_cache() function, allowing authenticated users with Subscriber-level access and above to clear the plugin's cache. This vulnerability could lead to unauthorized data loss.

Impact

Exploitation of this vulnerability allows for unauthorized cache clearing, which could disrupt the normal functioning of the plugin by causing data to be reloaded or regenerated, potentially leading to performance issues or loss of user-specific data.

Reproduction

To reproduce this vulnerability, an authenticated user with Subscriber-level access or higher can navigate to the zStore Manager Basic plugin's settings page. From there, the user can click the 'Clear Cache' button, which will trigger the cache clearing function without the necessary authorization checks.