CVE-2025-14442

MediumCVSS 5.3

Published: 12/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

23th percentile - higher than 23% of all known CVEs

Summary

The Secure Copy Content Protection and Content Locking plugin for WordPress up to version 4.9.2 stores exported CSV files in a publicly accessible directory with predictable filenames. Unauthenticated attackers can access sensitive user data including emails, IP addresses, usernames, roles, and location data.

Risk Assessment

Risk of mass leakage of personal user data, potentially violating GDPR and other regulations.

Recommendation

Update the plugin to the latest version. Move exported files to a protected directory and use random filenames.

Other vulnerabilities in Secure Copy Content Protection and Content Locking

CVE-2025-14159Medium
The Secure Copy Content Protection and Content Locking plugin for WordPress up to version 4.9.2 is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the 'ays_sccp_results_export_file' AJAX action. This allows unauthenticated attackers to export sensitive plugin data including email addresses, IP addresses, physical addresses, user IDs, and other user information via a forged request if they can trick a site administrator into clicking a link. The exported data is stored in a publicly accessible file, allowing attackers to receive the sensitive information even though they are not authenticated.

Original NVD description (English source)

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage of exported CSV files in a publicly accessible directory with predictable filenames in all versions up to, and including, 4.9.2. This makes it possible for unauthenticated attackers to access sensitive user data including emails, IP addresses, usernames, roles, and location data by directly accessing the exported CSV file.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS