Medium severity5.9NVD Advisory· Published Jun 14, 2025· Updated Jun 17, 2026

CVE-2025-4187

Description

The UserPro - Community and User Profile WordPress Plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.1.10 via the userpro_fbconnect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Affected products

WordPress/UserPro - Community and User Profile WordPress Pluginllm-create
Range: <=5.1.10
WordPress/Userprowp-canonicalize
Package: https://wordpress.org/plugins/userpro

Patches

Vulnerability mechanics

References

codecanyon.net/item/userpro-user-profiles-with-social-login/5958681nvd
www.wordfence.com/threat-intel/vulnerabilities/id/2745a40c-b011-4fe5-b2f7-d97ee6972568nvd

News mentions

No linked articles in our index yet.

cvss	0.384
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000