EUVD-2026-60803
GHSA-vcfr-hfg8-h8gf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization with no user interaction gives AV:N/AC:L/PR:N/UI:N; PHP object injection can compromise confidentiality, integrity, and availability, so C/I/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.
AnalysisAI
Insecure deserialization in the Youzify WordPress plugin (versions 1.3.7 and earlier) allows remote unauthenticated attackers to submit crafted serialized PHP objects that the plugin deserializes without validation, per a Patchstack advisory. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, successful exploitation can lead to object injection and potentially full site compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The affected component is the Youzify WordPress plugin at version 1.3.7 or earlier, reachable over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals partly align and partly leave gaps. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote attacker who does not need an account sends a crafted HTTP request to a Youzify endpoint containing a malicious PHP serialized object. When the plugin deserializes the input, magic methods on injected objects fire, and if a gadget chain is present in the site's code, the attacker achieves object injection leading to data theft, file manipulation, or code execution. … |
| Remediation | No vendor-released patch version was identified in the provided data, so confirm the fixed release via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/youzify/vulnerability/wordpress-youzify-plugin-1-3-7-deserialization-of-untrusted-data-vulnerability) and update Youzify to any version released after 1.3.7 once available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately disable or remove the Youzify plugin from all WordPress installations running version 1.3.7 or earlier and inventory all affected sites. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement vi
The Youzify WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputtin
The About Me widget of the Youzify - BuddyPress Community, User Profile, Social Network & Membership WordPress plugin be
Missing Authorization vulnerability in KaineLabs Youzify allows Exploiting Incorrectly Configured Access Control Securit
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in KaineLabs Youzify.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaineLabs Youzify
The Youzify - BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress
Authorization Bypass Through User-Controlled Key vulnerability in KaineLabs Youzify - BuddyPress Community, User Profile
The Youzify - BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress
The Youzify - BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today