The UserPro WordPress plugin contains a CWE-22 path traversal vulnerability in the userpro_fbconnect() function that permits unauthenticated remote attackers to read arbitrary files on the server. This affects all versions up to and including 5.1.10. The vulnerability allows attackers to bypass pathname restrictions, potentially exposing sensitive server files. The CVSS 3.1 base score is 5.9, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation allows unauthenticated attackers to read arbitrary files on the server hosting the vulnerable plugin. This can lead to disclosure of sensitive information, which may compromise server security or user data confidentiality. There is no indication of impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the UserPro plugin if feasible. Monitor official plugin sources for updates addressing this vulnerability.