Youzify BuddyPress Community Plugin for WordPress Missing Authorization Vulnerability Allowing Review Deletion

A vulnerability exists in the Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress, in all versions through 1.3.2. The issue arises from a lack of proper capability checks in the delete_user_review() and delete_review() functions. This flaw enables authenticated users with Subscriber-level access and above to delete reviews written by other users, leading to unauthorized data loss.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of user reviews, potentially disrupting community engagement and user interactions on the platform.

Remediation

Users are advised to update the Youzify BuddyPress Community Plugin for WordPress to version 1.3.3 or a newer patched version.