CVE-2024-12113
📋 TL;DR
This vulnerability allows authenticated WordPress users with Subscriber-level access or higher to delete other users' reviews in the Youzify plugin. It affects all WordPress sites using Youzify plugin versions up to 1.3.2. The issue stems from missing capability checks in delete_user_review() and delete_review() functions.
💻 Affected Systems
- Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
📦 What is this software?
Youzify by Kainelabs
⚠️ Risk & Real-World Impact
Worst Case
Malicious users could systematically delete all user reviews, damaging community trust and content integrity, potentially leading to business impact for review-dependent sites.
Likely Case
Individual users deleting reviews they disagree with or targeting specific users' content, causing content loss and user frustration.
If Mitigated
Limited to authenticated users only, with no data exfiltration or privilege escalation possible.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple once authenticated. The vulnerability is publicly disclosed with technical details available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.3 or later
Vendor Advisory: https://wordpress.org/plugins/youzify/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Youzify plugin and click 'Update Now'. 4. Verify update completes successfully.
🔧 Temporary Workarounds
Disable User Registration
allPrevent new user accounts from being created to limit potential attackers.
Navigate to WordPress Settings → General → Membership: Uncheck 'Anyone can register'
Disable Youzify Plugin
allTemporarily disable the vulnerable plugin until patched.
Navigate to WordPress Plugins → Installed Plugins → Youzify → Deactivate
🧯 If You Can't Patch
- Restrict user registration to trusted individuals only using manual approval workflows.
- Implement regular backups of WordPress database to restore deleted reviews if needed.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins → Youzify version. If version is 1.3.2 or lower, you are vulnerable.Check Version:
wp plugin list --name=youzify --field=versionVerify Fix Applied:
After updating, verify Youzify plugin version shows 1.3.3 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual frequency of review deletion actions in WordPress logs
- User accounts with Subscriber role performing delete_review operations
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with action parameters containing 'delete_review' or 'delete_user_review'
SIEM Query:
source="wordpress.log" AND (action="delete_review" OR action="delete_user_review") | stats count by user