Cross-Site Request Forgery in Secure Copy Content Protection Plugin for WordPress

CVE-2025-14159

What is CVE-2025-14159?

The Secure Copy Content Protection plugin for WordPress is susceptible to Cross-Site Request Forgery due to insufficient nonce validation within the 'ays_sccp_results_export_file' AJAX action. This flaw allows unauthenticated attackers to export sensitive data such as email addresses, IP addresses, physical addresses, user IDs, and other private user details without needing authentication. By tricking an administrator into executing a crafted request, attackers can access and exploit sensitive information stored in a publicly accessible file, posing significant privacy risks.

References