CVE-2025-69014
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A Server-Side Request Forgery (SSRF) vulnerability in the Youzify plugin (youzify) up to version 1.3.7. It allows an attacker to send requests from the server to internal resources, potentially leading to unauthorized access to data or services.
Risk Assessment
The risk includes potential exfiltration of internal data, scanning of internal networks, or attacks on other services, which may compromise confidentiality and integrity of the system.
Recommendation
Update the Youzify plugin to the latest version that includes security fixes and restrict access to internal resources from the server.
Other vulnerabilities in Youzify
See all- CVE-2026-73397Critical
Unauthenticated Deserialization of untrusted data vulnerability in Youzify plugin versions up to 1.3.7. An attacker without authentication can deserialize data, potentially leading to remote code execution.
- CVE-2026-39780High
The Youzify plugin in versions up to 1.3.7 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.
- CVE-2026-81275Medium
The Youzify plugin in versions up to and including 1.3.7 allows a Subscriber-level user to download arbitrary files. Insufficient path validation enables access to files outside the intended scope.
Original NVD description (English source)
Server-Side Request Forgery (SSRF) vulnerability in Youzify Youzify youzify allows Server Side Request Forgery.This issue affects Youzify: from n/a through <= 1.3.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS