CVE-2025-4187 MEDIUM

CVE-2025-4187: UserPro - Community and User Profile WordPress Plugin <= 5.1.10 - Unauthenticated Arbitrary File Read

Vendor N/A
Product UserPro - Community and User Profile WordPress Plugin
Weakness CWE-22 · Path traversal
Published June 14, 2025
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

The UserPro - Community and User Profile WordPress Plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.1.10 via the userpro_fbconnect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Explanation of Vulnerability in Simple Terms

02Summary

UserPro plugin versions up to 5.1.10 contain a path traversal vulnerability that allows an attacker to read files from the server without authentication. The vulnerability requires specific conditions to exploit but can expose sensitive files like configuration files or database backups. Site administrators should update to a version newer than 5.1.10 immediately.

What an attacker can do

03Attacker Capabilities

Read arbitrary files from the server, such as configuration files or backups.

Potential impact on your site

04Site Impact

Sensitive files on your server could be exposed, including database credentials or configuration data.

Conditions required to exploit

05Prerequisites

Network access to the site; specific conditions must be met to trigger the vulnerability.

Key dates

06Disclosure timeline

June 14, 2025 CVE published
April 8, 2026 Record updated