CVE-2026-73397

CriticalCVSS 9.8

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

32th percentile - higher than 32% of all known CVEs

Summary

Unauthenticated Deserialization of untrusted data vulnerability in Youzify plugin versions up to 1.3.7. An attacker without authentication can deserialize data, potentially leading to remote code execution.

Risk Assessment

Potential for remote code execution on the server, which may result in full system compromise.

Recommendation

Update the Youzify plugin to a version newer than 1.3.7.

Other vulnerabilities in Youzify

CVE-2026-81275Medium
The Youzify plugin in versions up to and including 1.3.7 allows a Subscriber-level user to download arbitrary files. Insufficient path validation enables access to files outside the intended scope.

Original NVD description (English source)

Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS