What the vulnerability does
01Description
The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.2. This is due to missing nonce validation on the 'ays_sccp_results_export_file' AJAX action. This makes it possible for unauthenticated attackers to export sensitive plugin data including email addresses, IP addresses, physical addresses, user IDs, and other user information via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The exported data is stored in a publicly accessible file, allowing attackers to receive the sensitive information even though they are not authenticated.
Explanation of Vulnerability in Simple Terms
02Summary
The Secure Copy Content Protection and Content Locking plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability in versions up to 4.9.2. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without their knowledge. This could allow unauthorized changes to plugin settings or content protection rules.
What an attacker can do
03Attacker Capabilities
Perform unwanted actions on the site by tricking an admin into visiting a malicious webpage.
Potential impact on your site
04Site Impact
An attacker could modify plugin settings or content protection rules without your permission.
Conditions required to exploit
05Prerequisites
Site admin must be logged in and visit an attacker-controlled webpage.
Key dates
06Disclosure timeline
December 12, 2025
CVE published
April 8, 2026
Record updated
