Youzify BuddyPress Plugin Missing Authorization Vulnerability in WordPress

A vulnerability exists in the Youzify - BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress, in all versions through 1.3.4. The issue arises from a missing capability check in the youzify_offer_banner() function, allowing authenticated attackers with Subscriber-level access and above to update arbitrary site options to a value of one.

Impact

Exploitation of this vulnerability allows for unauthorized updates of site options, which could be used to manipulate site behavior or settings.

Remediation

Users are advised to update the Youzify BuddyPress plugin to version 1.3.5 or a newer patched version.