UserPro WordPress Plugin Directory Traversal Vulnerability Allowing Unauthenticated Arbitrary File Read

A directory traversal vulnerability has been identified in the UserPro - Community and User Profile WordPress Plugin, affecting all versions through 5.1.10. The issue arises in the userpro_fbconnect() function, allowing unauthenticated attackers to read arbitrary files on the server that may contain sensitive information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information stored in files on the server.

Remediation

There is no known patch available for this vulnerability. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.