CVE-2026-81275

MediumCVSS 6.5

Published: 10/09/2026(UTC)Updated: 11/09/2026(UTC)Translated: 10/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.44%

37th percentile - higher than 37% of all known CVEs

Summary

The Youzify plugin in versions up to and including 1.3.7 allows a Subscriber-level user to download arbitrary files. Insufficient path validation enables access to files outside the intended scope.

Risk Assessment

A low-privileged attacker can download arbitrary files from the server, including configuration files containing credentials. This may lead to full site compromise.

Recommendation

Update the Youzify plugin to a version newer than 1.3.7 containing the fix. Check whether any unauthorized file downloads have occurred.

Other vulnerabilities in Youzify

CVE-2026-73397Critical
Unauthenticated Deserialization of untrusted data vulnerability in Youzify plugin versions up to 1.3.7. An attacker without authentication can deserialize data, potentially leading to remote code execution.

Original NVD description (English source)

Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS