CVE-2025-14442 Details
Description
The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage of exported CSV files in a publicly accessible directory with predictable filenames in all versions up to, and including, 4.9.2. This makes it possible for unauthenticated attackers to access sensitive user data including emails, IP addresses, usernames, roles, and location data by directly accessing the exported CSV file.
A vulnerability in the Secure Copy Content Protection and Content Locking plugin for WordPress, present in all versions through 4.9.2, allows for unauthorized access to sensitive user information. This issue arises because exported CSV files are stored in a publicly accessible directory with predictable filenames. Unauthenticated attackers can retrieve sensitive data such as emails, IP addresses, usernames, roles, and location information by directly accessing the exported CSV files.
Users are advised to update the plugin to version 4.9.3 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Dec 12, 2025CISA-ADP
Assessed Dec 12, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-552 | Files or Directories Accessible to External Parties | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Ays Pro Secure Copy Content Protection | <= 4.9.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 12, 2025 | New CVE Received | [email protected] |