CVE-2026-81275
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The Youzify plugin in versions up to and including 1.3.7 allows a Subscriber-level user to download arbitrary files. Insufficient path validation enables access to files outside the intended scope.
Risk Assessment
A low-privileged attacker can download arbitrary files from the server, including configuration files containing credentials. This may lead to full site compromise.
Recommendation
Update the Youzify plugin to a version newer than 1.3.7 containing the fix. Check whether any unauthorized file downloads have occurred.
Other vulnerabilities in Youzify
See all- CVE-2026-73397Critical
Unauthenticated Deserialization of untrusted data vulnerability in Youzify plugin versions up to 1.3.7. An attacker without authentication can deserialize data, potentially leading to remote code execution.
- CVE-2026-39780High
The Youzify plugin in versions up to 1.3.7 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.
- CVE-2025-69014Medium
A Server-Side Request Forgery (SSRF) vulnerability in the Youzify plugin (youzify) up to version 1.3.7. It allows an attacker to send requests from the server to internal resources, potentially leading to unauthorized access to data or services.
Original NVD description (English source)
Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS