CVE-2026-73397
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Unauthenticated Deserialization of untrusted data vulnerability in Youzify plugin versions up to 1.3.7. An attacker without authentication can deserialize data, potentially leading to remote code execution.
Risk Assessment
Potential for remote code execution on the server, which may result in full system compromise.
Recommendation
Update the Youzify plugin to a version newer than 1.3.7.
Other vulnerabilities in Youzify
See all- CVE-2026-39780High
The Youzify plugin in versions up to 1.3.7 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.
- CVE-2026-81275Medium
The Youzify plugin in versions up to and including 1.3.7 allows a Subscriber-level user to download arbitrary files. Insufficient path validation enables access to files outside the intended scope.
- CVE-2025-69014Medium
A Server-Side Request Forgery (SSRF) vulnerability in the Youzify plugin (youzify) up to version 1.3.7. It allows an attacker to send requests from the server to internal resources, potentially leading to unauthorized access to data or services.
Original NVD description (English source)
Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS