WordPress Plugin Vulnerabilities

Youzify < 1.2.8 - Missing Authorization

Description

The Youzify plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.2.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
youzify
Fixed in 1.2.8

References

CVE
CVE-2024-39635
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/f8390dc5-24db-4d39-ba26-eaa87d260f1c

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
LVT-tholv2k
Verified
No
WPVDB ID
cd339e30-f331-44dd-bca8-52acae14efdc

Timeline

Publicly Published
2024-07-24 (about 1 year ago)
Added
2024-08-01 (about 1 year ago)
Last Updated
2024-08-01 (about 1 year ago)

Other

Published
Title
Published
2025-04-16
Title
WowStore < 4.2.5 - Missing Authorization
Published
2025-03-14
Title
Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection
Published
2026-01-14
Title
X Addons for Elementor <= 1.0.23 - Missing Authorization
Published
2024-02-26
Title
Categorify < 1.0.7.5 - Missing Authorization in categorifyAjaxAddCategory
Published
2025-03-13
Title
Search and filter pro < 2.5.20 - Missing Authorization to Authenticated (Subscriber+) Post Meta Exposure