CVE-2024-39635: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability has been identified in KaineLabs Youzify plugin versions through 1.2.6. The vulnerability, tracked as CVE-2024-39635, was discovered on July 24, 2024, and involves broken access control issues that could allow exploiting incorrectly configured access control security levels (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. The issue is classified under CWE-862 (Missing Authorization) and requires subscriber-level privileges to exploit (Patchstack).

The vulnerability is categorized as a broken access control issue, which refers to a missing authorization, authentication, or nonce token check in a function. This could potentially allow an unprivileged user to execute certain higher privileged actions (Patchstack).

The vulnerability has been fixed in version 1.2.8 of the Youzify plugin. Users are advised to update to version 1.2.8 or later to remove the vulnerability. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users update to the fixed version (Patchstack).