CVE-2025-14159
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Secure Copy Content Protection and Content Locking plugin for WordPress up to version 4.9.2 is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the 'ays_sccp_results_export_file' AJAX action. This allows unauthenticated attackers to export sensitive plugin data including email addresses, IP addresses, physical addresses, user IDs, and other user information via a forged request if they can trick a site administrator into clicking a link. The exported data is stored in a publicly accessible file, allowing attackers to receive the sensitive information even though they are not authenticated.
Risk Assessment
Exposure of sensitive user data could lead to privacy breaches, identity theft, or other attacks on users, as well as non-compliance with data protection regulations.
Recommendation
Update the Secure Copy Content Protection and Content Locking plugin to the latest version immediately, which includes CSRF protections.
Other vulnerabilities in Secure Copy Content Protection and Content Locking
Original NVD description (English source)
The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.2. This is due to missing nonce validation on the 'ays_sccp_results_export_file' AJAX action. This makes it possible for unauthenticated attackers to export sensitive plugin data including email addresses, IP addresses, physical addresses, user IDs, and other user information via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The exported data is stored in a publicly accessible file, allowing attackers to receive the sensitive information even though they are not authenticated.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS