CVE-2025-14442

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14442", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-10T13:08:38.289Z", "datePublished": "2025-12-12T11:15:49.472Z", "dateUpdated": "2026-04-08T17:00:49.330Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:00:49.330Z"}, "affected": [{"vendor": "ays-pro", "product": "Secure Copy Content Protection and Content Locking", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.9.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage of exported CSV files in a publicly accessible directory with predictable filenames in all versions up to, and including, 4.9.2. This makes it possible for unauthenticated attackers to access sensitive user data including emails, IP addresses, usernames, roles, and location data by directly accessing the exported CSV file."}], "title": "Secure Copy Content Protection and Content Locking <= 4.9.2 - Unauthenticated Sensitive Information Exposure via Exposed CSV Export File", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/72b95777-d17b-4504-95fd-c83b18106b9e?source=cve"}, {"url": "https://wordpress.org/plugins/secure-copy-content-protection/#developers"}, {"url": "https://plugins.trac.wordpress.org/browser/secure-copy-content-protection/tags/4.9.0/admin/class-secure-copy-content-protection-admin.php#L557"}, {"url": "https://plugins.trac.wordpress.org/browser/secure-copy-content-protection/tags/4.9.3/admin/class-secure-copy-content-protection-admin.php#L560"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-552 Files or Directories Accessible to External Parties", "cweId": "CWE-552", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Deadbee"}], "timeline": [{"time": "2025-12-10T13:23:46.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-11T21:22:25.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-12T15:31:33.201528Z", "id": "CVE-2025-14442", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T15:31:40.218Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14442", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T15:31:33.201528Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T14:42:16.421Z"}}], "cna": {"title": "Secure Copy Content Protection and Content Locking <= 4.9.2 - Unauthenticated Sensitive Information Exposure via Exposed CSV Export File", "credits": [{"lang": "en", "type": "finder", "value": "Deadbee"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "ays-pro", "product": "Secure Copy Content Protection and Content Locking", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.9.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-10T13:23:46.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-11T21:22:25.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/72b95777-d17b-4504-95fd-c83b18106b9e?source=cve"}, {"url": "https://wordpress.org/plugins/secure-copy-content-protection/#developers"}, {"url": "https://plugins.trac.wordpress.org/browser/secure-copy-content-protection/tags/4.9.0/admin/class-secure-copy-content-protection-admin.php#L557"}, {"url": "https://plugins.trac.wordpress.org/browser/secure-copy-content-protection/tags/4.9.3/admin/class-secure-copy-content-protection-admin.php#L560"}], "descriptions": [{"lang": "en", "value": "The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage of exported CSV files in a publicly accessible directory with predictable filenames in all versions up to, and including, 4.9.2. This makes it possible for unauthenticated attackers to access sensitive user data including emails, IP addresses, usernames, roles, and location data by directly accessing the exported CSV file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-552", "description": "CWE-552 Files or Directories Accessible to External Parties"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-12T11:15:49.472Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14442", "state": "PUBLISHED", "dateUpdated": "2025-12-12T15:31:40.218Z", "dateReserved": "2025-12-10T13:08:38.289Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-12T11:15:49.472Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Secure Copy Content Protection and Content Locking", "vendor": "ays-pro", "versions": [{"lessThanOrEqual": "4.9.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage of exported CSV files in a publicly accessible directory with predictable filenames in all versions up to, and including, 4.9.2. This makes it possible for unauthenticated attackers to access sensitive user data including emails, IP addresses, usernames, roles, and location data by directly accessing the exported CSV file."}, {"lang": "es", "value": "El plugin Secure Copy Content Protection and Content Locking para WordPress es vulnerable a la exposici\u00f3n de informaci\u00f3n sensible debido al almacenamiento de archivos CSV exportados en un directorio de acceso p\u00fablico con nombres de archivo predecibles en todas las versiones hasta la 4.9.2, inclusive. Esto hace posible que atacantes no autenticados accedan a datos de usuario sensibles, incluyendo correos electr\u00f3nicos, direcciones IP, nombres de usuario, roles y datos de ubicaci\u00f3n, al acceder directamente al archivo CSV exportado."}], "id": "CVE-2025-14442", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14442", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-12T15:31:33.201528Z", "version": "2.0.3"}}]}, "published": "2025-12-12T12:15:46.377", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/secure-copy-content-protection/tags/4.9.0/admin/class-secure-copy-content-protection-admin.php#L557"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/secure-copy-content-protection/tags/4.9.3/admin/class-secure-copy-content-protection-admin.php#L560"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/secure-copy-content-protection/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/72b95777-d17b-4504-95fd-c83b18106b9e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-552"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:19:53.672066+00:00", "value": {"mitigation_remediation": ["Update the plugin to version 4.9.3 or later to eliminate the insecure CSV export functionality.", "Verify that the plugin\u2019s export folder is outside the web root or protected by access controls such as .htaccess or similar.", "If the plugin cannot be updated, disable or uninstall it, or modify the file permissions so that exported files are not publicly readable."], "summary": {"action": "Apply Patch", "impact": "Sensitive Information Exposure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the WordPress plugin Secure Copy Content Protection and Content Locking, versions 4.9.2 and earlier. The plugin is distributed by ays-pro.", "description_and_impact": "The plugin allows exporting data to CSV files that contain emails, IP addresses, usernames, role information, and location data. These files are stored in a publicly accessible directory using predictable filenames. An attacker who does not need authentication can download the CSV and gain sensitive user information, which can be used for phishing, credential harvesting, or other attacks.", "risk_and_exploitability": "CVSS score of 5.3 indicates a medium severity vulnerability. The EPSS score of less than 1% shows that exploitation is considered unlikely at present. It is not listed in the CISA KEV catalog, so no confirmed widespread exploitation is known. However, because access to the CSV files is unauthenticated and the files are placed in a public folder, an attacker can obtain the data by simply visiting the file URL, without needing to exploit any code or perform further actions."}}}}, "created": "2025-12-14T21:16:36.661053+00:00", "updated": "2026-04-21T17:30:37.687110+00:00", "vendors": ["ays-pro", "ays-pro$PRODUCT$secure_copy_content_protection_and_content_locking", "wordpress", "wordpress$PRODUCT$wordpress"]}