CVE-2025-1404

MEDIUM

Secure Copy Content Protection <=4.4.7 - Unauthenticated Email Disclosure

Title source: llm

Description

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_sccp_reports_user_search() function in all versions up to, and including, 4.4.7. This makes it possible for unauthenticated attackers to retrieve a list of registered user emails.

References (5)

Core 5

Core References

Product

https://plugins.trac.wordpress.org/browser/secure-copy-content-protection/tags/4.4.6/admin/class-secure-copy-content-protection-admin.php#L943

Product

https://plugins.trac.wordpress.org/browser/secure-copy-content-protection/tags/4.4.6/admin/js/secure-copy-content-protection-admin.js

Product

https://wordpress.org/plugins/secure-copy-content-protection/#developers

Product

https://plugins.trac.wordpress.org/changeset/3246301

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/7363b5de-db30-4b35-b701-5c8f2835ec6c?source=cve

Scores

CVSS v3 5.3

EPSS 0.0037

EPSS Percentile 28.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (1)

ays-pro/Secure Copy Content Protection and Content Locking < 4.4.7

Published Mar 01, 2025

Tracked Since Feb 18, 2026