Sensitive Information Exposure in Secure Copy Content Protection Plugin for WordPress

CVE-2025-14442

What is CVE-2025-14442?

The Secure Copy Content Protection plugin for WordPress has a serious vulnerability that allows unauthenticated attackers to access sensitive user data. This occurs due to the plugin’s tendency to store exported CSV files in a publicly accessible directory with predictable filenames. Consequently, attackers can exploit this weakness to retrieve sensitive information such as user emails, IP addresses, usernames, roles, and geographical location data by directly accessing the exported files. Users of versions up to 4.9.2 are particularly at risk, and immediate action is advised to secure their data.

References