Unauthorized Access Vulnerability in Youzify Plugin for WordPress
CVE-2024-13368
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 25 January 2025
What is CVE-2024-13368?
The Youzify plugin, designed for creating social networks on WordPress, suffers from a security flaw due to a missing capability check in the youzify_offer_banner() function. This vulnerability affects all versions of the plugin up to and including 1.3.2, enabling authenticated attackers with Subscriber-level access or greater to manipulate site options. This can lead to unauthorized changes, posing a significant threat to the integrity of affected WordPress sites.
Affected Version(s)
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress * <= 1.3.2