Input validation vulnerability in UserPro – Community and User Profile WordPress Plugin 5.1.1

The UserPro plugin for WordPress, up to version 5.1.1, has a security vulnerability that can be exploited by unauthenticated attackers. If they can get a site administrator to do something like click on a link, they can use a special request to modify the role of verified users and give them the same privileges as any user, such as an Administrator. This is possible because of the lack of validation in the ‘admin_page’, ‘userpro_verify_user’ and ‘verifyUnverifyAllUsers’ functions.