Youzify BuddyPress Plugin Missing Authorization Vulnerability in WordPress

A vulnerability exists in the Youzify BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress, in all versions through 1.3.3. The issue arises from a missing capability check in the save_addon_key_license() function, allowing authenticated attackers with Subscriber-level access and above to update arbitrary options with a valid license key. This unauthorized access could be exploited to manipulate license-related settings, potentially leading to unauthorized premium features or updates.

Impact

Exploitation of this vulnerability allows for unauthorized modification of license keys, which could be used to gain access to premium features or updates that require a valid license.

Remediation

Users are advised to update the Youzify BuddyPress Plugin to version 1.3.4 or later, where this vulnerability has been patched.