Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Authenticated (Subscriber+) Arbitrary File Read

Description

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.3.7. This is due to insufficient validation of a user supplied path. This makes it possible for authenticated attackers, with subscriber-level access and above, to read arbitrary files on the server, including sensitive configuration files.