The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress contains a missing authorization (CWE-862) vulnerability in the save_addon_key_license() function in all versions up to 1.3.3. This flaw permits authenticated users with minimal privileges (Subscriber-level and above) to update arbitrary plugin options by supplying a valid license key, due to the absence of a capability check. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting low attack complexity and no user interaction required, but limited to integrity impact without affecting confidentiality or availability.

An attacker with Subscriber-level access or higher can modify plugin license key options without proper authorization. This could lead to unauthorized license key updates, potentially affecting plugin licensing enforcement or functionality. There is no direct impact on data confidentiality or system availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals and monitor for unauthorized changes to plugin license settings. Avoid granting Subscriber-level or higher privileges to untrusted users.