CVE-2021-24931

CRITICAL EXPLOITED NUCLEI

Wordpress Secure Copy Content Protection and Content Locking sccp_id Unauthenticated SQLi

Title source: metasploit

Description

The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection.

Exploits (2)

exploitdb WORKING POC
by Ron Jost · pythonwebappsphp
https://www.exploit-db.com/exploits/50733
metasploit WORKING POC
by h00die, Hacker5preme (Ron Jost), Krzysztof Zając (kazet) · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wp_secure_copy_content_protection_sqli.rb

Nuclei Templates (1)

WordPress Secure Copy Content Protection and Content Locking <2.8.2 - SQL Injection
CRITICALVERIFIEDby theamanrawat

References (2)

Scores

CVSS v3 9.8
EPSS 0.7197
EPSS Percentile 98.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation Intel

VulnCheck KEV 2023-11-22

Classification

CWE
CWE-89
Status published

Affected Products (1)

ays-pro/secure_copy_content_protection_and_content_locking < 2.8.2

Timeline

Published Dec 06, 2021
Tracked Since Feb 18, 2026