CVE-2025-14442
Unknown Unknown - Not Provided
Sensitive Data Exposure in Secure Copy Plugin via Public CSV Access

Publication date: 2025-12-12

Last updated on: 2025-12-12

Assigner: Wordfence

Description
The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage of exported CSV files in a publicly accessible directory with predictable filenames in all versions up to, and including, 4.9.2. This makes it possible for unauthenticated attackers to access sensitive user data including emails, IP addresses, usernames, roles, and location data by directly accessing the exported CSV file.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-12
Last Modified
2025-12-12
Generated
2026-05-06
AI Q&A
2025-12-12
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wordpress wordpress *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-552 The product makes files or directories accessible to unauthorized actors, even though they should not be.
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

This vulnerability exposes sensitive user data such as emails, IP addresses, usernames, roles, and location data by storing exported CSV files in a publicly accessible directory with predictable filenames. Such exposure of personal and potentially sensitive information could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal data against unauthorized access. Therefore, organizations using the affected plugin may face compliance risks due to this vulnerability.


How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability can be detected by scanning your web server for publicly accessible exported CSV files with predictable filenames created by the Secure Copy Content Protection plugin (versions up to 4.9.2). You can look for CSV files in the plugin's export directory. For example, use commands like `curl` or `wget` to attempt to access known or guessed CSV filenames directly via HTTP. Additionally, you can use tools like `grep` or `find` on your server to locate CSV files in the plugin directories. Example commands: `curl http://yourwebsite.com/wp-content/plugins/secure-copy-content-protection/exports/exported-file.csv` or `find /path/to/wordpress/wp-content/plugins/secure-copy-content-protection/ -name '*.csv'` to locate CSV files stored locally.


What immediate steps should I take to mitigate this vulnerability?

Immediate mitigation steps include: 1) Restrict access to the directory where exported CSV files are stored by configuring your web server (e.g., using .htaccess rules for Apache or location blocks for Nginx) to deny public access to these files. 2) Remove or secure any existing exported CSV files that contain sensitive user data. 3) Update the Secure Copy Content Protection plugin to a version later than 4.9.2 once available, or disable the plugin until a fix is released. 4) Review and adjust file permissions to ensure sensitive files are not publicly readable. These steps help prevent unauthenticated attackers from accessing sensitive exported data.


Can you explain this vulnerability to me?

This vulnerability exists in the Secure Copy Content Protection and Content Locking plugin for WordPress (up to version 4.9.2). It involves the storage of exported CSV files containing sensitive user information in a publicly accessible directory with predictable filenames. Because of this, unauthenticated attackers can directly access these CSV files and obtain sensitive data such as emails, IP addresses, usernames, roles, and location data.


How can this vulnerability impact me? :

The vulnerability can lead to exposure of sensitive user information to unauthorized parties. This can result in privacy breaches, potential identity theft, targeted attacks, or misuse of user data since attackers can access emails, IP addresses, usernames, roles, and location data without authentication.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart