Unauthorized Data Loss in Youzify Plugin for WordPress
CVE-2024-12113
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 25 January 2025
What is CVE-2024-12113?
The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress contains a significant security flaw that permits authenticated users, with Subscriber-level access and above, to delete reviews posted by other users. This vulnerability stems from a missing capability check in the delete_user_review() and delete_review() functions, allowing these authorized users unauthorized access to sensitive actions. Users of the Youzify plugin are advised to update to the latest version to mitigate potential risks and safeguard user-generated content.
Affected Version(s)
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress * <= 1.3.2