Arbitrary File Download Vulnerability in Youzify Plugin by Youzify
CVE-2026-81275

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Youzify
Vendor
CVE Published:
10 September 2026

What is CVE-2026-81275?

The Youzify Plugin for WordPress contains a vulnerability that allows an attacker to exploit arbitrary file downloads in versions up to 1.3.7. This security flaw can enable unauthorized access to sensitive files on the server, posing significant risks to users and site integrity. It is crucial for WordPress site administrators to update to the latest version to mitigate this risk.

Affected Version(s)

Youzify <= 1.3.7

References

https://patchstack.com/database/wordpress/plugin/youzify/...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dodoh4t | Patchstack Bug Bounty Program
.