Skip to main content

Youzify CVE-2026-81275

| EUVDEUVD-2026-75514 MEDIUM
Path Traversal (CWE-22)
2026-09-10 Patchstack GHSA-hq7q-5jw3-hg72
WordPress Path Traversal Youzify Wordpress Plugin
6.5
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
6.5 MEDIUM

Network-accessible endpoint, no complexity; PR:L (subscriber account required); confidentiality-only impact with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Sep 10, 2026 - 15:19 vuln.today
CVE Published
Sep 10, 2026 - 14:23 cve.org
MEDIUM 6.5

DescriptionCVE.org

Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions.

AnalysisAI

Path traversal in the Youzify WordPress plugin (versions ≤ 1.3.7) allows any authenticated subscriber to download arbitrary files from the hosting server. The flaw stems from insufficient sanitization of user-supplied file path input (CWE-22), enabling directory traversal sequences to escape the intended download scope. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid subscriber-level WordPress account on a site running Youzify ≤ 1.3.7. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately characterizes this as a medium-severity confidentiality-only issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Update the Youzify plugin to a version above 1.3.7 as soon as a patched release is available from the WordPress plugin repository or the vendor. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Youzify

View all
CVE-2022-1950 CRITICAL POC
9.8 Aug 01

The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement vi
CVE-2026-73397 CRITICAL
9.8 Aug 18

Insecure deserialization in the Youzify WordPress plugin (versions 1.3.7 and earlier) allows remote unauthenticated atta
CVE-2023-0059 MEDIUM POC
5.4 Feb 21

The Youzify WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputtin
CVE-2021-24443 MEDIUM POC
5.4 Aug 02

The About Me widget of the Youzify - BuddyPress Community, User Profile, Social Network & Membership WordPress plugin be
CVE-2024-39635 HIGH
8.8 Nov 01

Missing Authorization vulnerability in KaineLabs Youzify allows Exploiting Incorrectly Configured Access Control Securit
CVE-2024-37494 HIGH
8.8 Jul 09

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in KaineLabs Youzify.
CVE-2024-2864 HIGH
7.3 Mar 25

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaineLabs Youzify

CVE-2024-4742 MEDIUM
6.5 Jun 20

The Youzify - BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress

CVE-2024-13370 MEDIUM
6.5 Jan 25

The Youzify - BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress

CVE-2023-47191 MEDIUM
6.5 Dec 21

Authorization Bypass Through User-Controlled Key vulnerability in KaineLabs Youzify - BuddyPress Community, User Profile
CVE-2024-8987 MEDIUM
6.4 Oct 10

The Youzify - BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress

CVE-2026-1559 MEDIUM
6.4 Apr 18

Youzify plugin for WordPress (versions up to 1.3.6) allows authenticated subscribers to execute stored cross-site script

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Share

CVE-2026-81275 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy