PT-2025-50925 · WordPress · Content Locking+1

Deadbee · Published 2025-12-12 · Updated 2025-12-12 · CVE-2025-14159

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Secure Copy Content Protection and Content Locking plugin for WordPress versions through 4.9.2

Description The plugin is susceptible to Cross-Site Request Forgery due to the absence of nonce validation on the ays sccp results export file AJAX action. This allows unauthenticated attackers to export sensitive plugin data, including email addresses, IP addresses, physical addresses, user IDs, and other user information, by deceiving a site administrator into performing an action. The exported data is stored in a publicly accessible file, enabling attackers to obtain the sensitive information without authentication.

Recommendations Versions prior to and including 4.9.2 should be updated to a newer, fixed version when available. As a temporary workaround, consider disabling the ays sccp results export file AJAX action until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-14159

Affected Products

Content Locking

Secure Copy Content Protection

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-14159 · Security Note
• https://wordpress.org/plugins/secure-copy-content-protection/#developers · Note
• https://t.me/CVEtracker/39618 · Telegram Post
• https://plugins.trac.wordpress.org/browser/secure-copy-content-protection/tags/4.9.3/admin/class-secure-copy-content-protection-admin.php#L696 · Note
• https://plugins.trac.wordpress.org/browser/secure-copy-content-protection/tags/4.8.7/admin/class-secure-copy-content-protection-admin.php#L645 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7cffe04e-a2e5-4752-a5c1-7c95f0007e0b?source=cve · Note