CVE-2024-9067 MEDIUM

CVE-2024-9067: Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Missing Authorization to Arbitrary (Subscriber+) Attachment Deletion

Vendor Youzify
Product Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
Weakness CWE-862 · Missing authorization
Published October 10, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'delete_attachment' function in all versions up to, and including, 1.3.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary attachments.

Key dates

02Disclosure timeline

October 10, 2024 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-14971 Link Invoice Payment for WooCommerce <= 2.8.0 - Missing Authorization to Unauthenticated Arbitrary Partial Payment Creation/Cancellation CVE-2023-45760 WordPress wpDiscuz plugin <= 7.6.3 - Broken Access Control vulnerability CVE-2022-44438 CVE-2023-3126 B2BKing <= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Information Disclosure CVE-2025-48272 WordPress WP Job Portal plugin <= 2.3.2 - Insecure Direct Object References (IDOR) Vulnerability