Directory Traversal Vulnerability in UserPro WordPress Plugin by WordPress

CVE-2025-4187

What is CVE-2025-4187?

The UserPro - Community and User Profile WordPress Plugin is susceptible to a directory traversal vulnerability, allowing unauthenticated attackers to exploit the userpro_fbconnect() function. This flaw enables attackers to access arbitrary files on the server, which may contain sensitive data, risking user privacy and security. Website administrators should take immediate measures to update or mitigate the vulnerabilities in affected versions.

References