What is the CVSS score of EUVD-2026-60803?

EUVD-2026-60803 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Youzify are affected by EUVD-2026-60803?

The Youzify WordPress plugin (versions 1.3.7 and earlier) contains a critical insecure deserialization vulnerability (CVE-2026-73397, CVSS 9.8) that enables remote attackers to achieve…

How to fix or mitigate EUVD-2026-60803?

Within 24 hours, immediately disable or remove the Youzify plugin from all WordPress installations running version 1.3.7 or earlier and inventory all affected sites. Within 7 days, forensically examine each affected site for evidence of compromise by reviewing access logs, database audit trails, file modification timestamps, and administrative account activity; restore from verified clean backups if any suspicious activity is detected. Within 30 days, monitor Patchstack security advisories and official Youzify release channels for patch availability; upon release, apply the patched version to all systems and conduct validation testing before re-enabling the plugin.

Youzify EUVD-2026-60803

| CVE-2026-73397 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-18 Patchstack

GHSA-vcfr-hfg8-h8gf

WordPress Deserialization Youzify Wordpress Plugin

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable deserialization with no user interaction gives AV:N/AC:L/PR:N/UI:N; PHP object injection can compromise confidentiality, integrity, and availability, so C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 14:53 vuln.today

CVE Published

Aug 18, 2026 - 14:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.

AnalysisAI

Insecure deserialization in the Youzify WordPress plugin (versions 1.3.7 and earlier) allows remote unauthenticated attackers to submit crafted serialized PHP objects that the plugin deserializes without validation, per a Patchstack advisory. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, successful exploitation can lead to object injection and potentially full site compromise. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Youzify is a BuddyPress-based community, user-profile, and social-network plugin for WordPress. The flaw is a CWE-502 (Deserialization of Untrusted Data) weakness: attacker-controlled input reaches a PHP unserialize() call (or an equivalent that instantiates serialized objects) without a whitelist or integrity check. In PHP/WordPress this class of bug enables PHP Object Injection, where crafted serialized objects trigger magic methods (__wakeup, __destruct) and, if a suitable gadget chain exists in the plugin, WordPress core, or other installed plugins, escalate to file writes, SQL manipulation, or code execution. The CPE cpe:2.3:a:youzify:youzify:*:*:*:*:*:*:*:* confirms the affected component is the Youzify application/plugin itself.

RemediationAI

No vendor-released patch version was identified in the provided data, so confirm the fixed release via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/youzify/vulnerability/wordpress-youzify-plugin-1-3-7-deserialization-of-untrusted-data-vulnerability) and update Youzify to any version released after 1.3.7 once available. Until a confirmed patched version is installed, the strongest compensating control is to deactivate and remove the Youzify plugin (side effect: loss of community/profile functionality); if that is not acceptable, restrict access to the endpoints that accept Youzify input via a WAF rule that blocks PHP serialized-object patterns (e.g. strings matching O:\d+: or a:\d+:{) in requests (side effect: possible false positives on legitimate serialized payloads), and limit or authenticate access to affected front-end features. Monitor logs for anomalous POST parameters to Youzify handlers.