CVE-2024-12113 in Youzify Plugin
Summary
by MITRE • 01/25/2025
The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_user_review() and delete_review() functions in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete other user's reviews.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/29/2025
The vulnerability identified as CVE-2024-12113 affects the Youzify plugin for WordPress, a popular solution for creating community platforms, user profiles, and social networking features within WordPress environments. This plugin serves as a comprehensive membership and social network solution that integrates with BuddyPress to provide community-building functionalities. The flaw exists within the plugin's access control mechanisms, specifically in functions responsible for managing user-generated content reviews. The vulnerability represents a critical authorization bypass issue that undermines the integrity of user content management within the platform.
The technical implementation of this vulnerability stems from insufficient capability checks within the delete_user_review() and delete_review() functions. These functions are designed to handle the removal of user reviews but fail to properly verify whether the authenticated user possesses adequate permissions to perform such deletions. The missing capability check creates a path where any user with Subscriber-level access or higher can execute these deletion functions against reviews created by other users. This represents a direct violation of the principle of least privilege and demonstrates poor input validation and access control implementation. The flaw is particularly concerning because it affects all versions of the plugin up to and including version 1.3.2, indicating a long-standing issue that has not been properly addressed.
The operational impact of this vulnerability extends beyond simple data loss, creating significant risks for community platforms and social networks that rely on user-generated content. An authenticated attacker with Subscriber privileges can systematically delete reviews created by other users, potentially disrupting community engagement, damaging user relationships, and undermining the platform's credibility. This capability could be exploited for harassment campaigns, competitive sabotage, or to remove negative feedback that might otherwise impact platform reputation. The vulnerability affects the fundamental data integrity aspects of the platform, as it allows for unauthorized modification of user content that forms the basis of community interaction and social networking features. Such unauthorized deletions can have cascading effects on user trust and platform stability.
Organizations utilizing the Youzify plugin should immediately implement mitigations to address this vulnerability, including updating to the latest available version where the issue has been resolved. The plugin developers should implement proper capability checks using WordPress's built-in permission systems to ensure that only users with appropriate privileges, such as administrators or moderators, can delete reviews belonging to other users. This aligns with the principle of least privilege and follows established security practices for content management systems. Security professionals should also consider implementing additional monitoring and logging mechanisms to detect unauthorized deletion activities, as this vulnerability could be exploited systematically. The mitigation strategy should include reviewing user roles and capabilities to ensure that subscribers and other lower-privilege users do not have unnecessary administrative functions. This vulnerability demonstrates the importance of proper access control implementation and highlights the need for regular security audits of third-party plugins, particularly those handling user-generated content and community features. The issue relates to CWE-284, which addresses improper access control, and could be mapped to ATT&CK technique T1485, which involves data destruction through unauthorized access to system resources.