PT-2025-50926 · WordPress · Secure Copy Content Protection/Content Locking

Deadbee · Published 2025-12-12 · Updated 2025-12-12 · CVE-2025-14442

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Secure Copy Content Protection and Content Locking versions prior to 4.9.2

Description The Secure Copy Content Protection and Content Locking plugin for WordPress exhibits sensitive information exposure. This occurs because exported CSV files are stored in a publicly accessible directory using predictable filenames. An unauthenticated attacker can access sensitive user data, including emails, IP addresses, usernames, roles, and location data, by directly accessing these CSV files.

Recommendations Update Secure Copy Content Protection and Content Locking to a version newer than 4.9.2.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2025-14442

Affected Products

Secure Copy Content Protection/Content Locking

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-14442 · Security Note
• https://wordpress.org/plugins/secure-copy-content-protection/#developers · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/72b95777-d17b-4504-95fd-c83b18106b9e?source=cve · Note
• https://t.me/CVEtracker/39619 · Telegram Post
• https://plugins.trac.wordpress.org/browser/secure-copy-content-protection/tags/4.9.0/admin/class-secure-copy-content-protection-admin.php#L557 · Note
• https://plugins.trac.wordpress.org/browser/secure-copy-content-protection/tags/4.9.3/admin/class-secure-copy-content-protection-admin.php#L560 · Note