Youzify BuddyPress Plugin Vulnerable to SQL Injection

CVE-2024-4742

Summary

The Youzify BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress is susceptible to an SQL Injection vulnerability. This flaw is due to inadequate escaping of user-supplied parameters in the order_by shortcode attribute, leading to potential manipulation of SQL queries. Authenticated users with Contributor-level access or higher can exploit this vulnerability to inject additional SQL commands into existing database queries. Such actions may result in unauthorized access to sensitive information stored in the database, highlighting the need for immediate attention to secure the affected versions of the plugin.

References