Input validation vulnerability in UserPro – Community and User Profile WordPress Plugin 5.1.0

The UserPro plugin for WordPress, up to and including version 5.1.0, is vulnerable to an attack called Cross-Site Request Forgery. This means that unauthenticated attackers may be able to trick a site administrator into performing an action, such as clicking on a link, that could exploit a security flaw in the plugin’s code. This is because the plugin is using an incomplete or incorrect form of security called ‘nonce validation’ on the ‘import_settings’ function, which may allow attackers to use a technique called ‘PHP Object Injection’ in order to access a website’s data.