CVE-2024-12113
CVE-2024-12113 affects the Youzify WordPress plugin, allowing unauthorized users to delete reviews. This vulnerability lets authenticated attackers with even Subscriber-level access delete other users' reviews due to missing capability checks in the delete_user_review() and delete_review() functions. The Youzify plugin, up to version 1.3.2, is susceptible to this data loss issue, potentially harming user trust and content integrity. While the CVSS score is 4.3, indicating moderate severity, the SOCRadar Vulnerability Risk Score (SVRS) of 34 suggests a relatively low immediate risk. However, the presence of the "In The Wild" tag indicates potential active exploitation, warranting careful monitoring and patching to prevent unauthorized review deletion and maintain data integrity within the WordPress environment. This vulnerability could enable malicious actors to manipulate user feedback and damage the reputation of individuals or businesses. Addressing this issue by updating the plugin is essential for preserving the integrity of user-generated content.
Description
CVE-2024-12113 affects the Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin. This vulnerability arises from a missing capability check in the delete_user_review() and delete_review() functions, allowing authenticated attackers with Subscriber-level access or higher to delete reviews written by other users. While the CVSS score is 4.3, indicating a medium severity, the SVRS score of 34 suggests a lower risk level, indicating that immediate action may not be critical.
Key Insights
- Impact: The vulnerability allows unauthorized deletion of user reviews, potentially impacting website reputation, user trust, and data integrity.
- Exploitation: This vulnerability can be exploited by authenticated attackers with Subscriber-level access or higher. Attackers could potentially use this vulnerability to remove negative reviews or manipulate website content.
- Scope: The vulnerability affects all versions of the Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin up to and including 1.3.2.
- CWE: The vulnerability falls under CWE-862: Missing Authorization, highlighting the lack of proper authentication and authorization mechanisms.
Mitigation Strategies
- Update the Plugin: The most effective mitigation strategy is to update the Youzify plugin to the latest version, which is likely to address this vulnerability.
- Implement Access Control: Ensure strict access controls are implemented for user reviews and other sensitive data, limiting access based on user roles and permissions.
- Regular Security Audits: Conduct regular security audits of the WordPress website and plugins to identify and remediate vulnerabilities proactively.
- Monitor for Suspicious Activity: Continuously monitor the website for any unusual activity or attempts to delete reviews, and investigate any suspicious events promptly.
Additional Information
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.