The Secure Copy Content Protection and Content Locking plugin for WordPress contains a missing capability check in the ays_sccp_reports_user_search function. This flaw allows an unauthenticated attacker to call the function and retrieve a complete list of registered user email addresses. The vulnerability is a classic example of missing authorization, classified as CWE-862, and results in a confidentiality breach that could be leveraged for social phishing or targeted credential harvesting.

This issue affects all installed instances of the Secure Copy Content Protection and Content Locking plugin with versions up to and including 4.4.7. Administrators using WordPress sites that rely on this plugin should verify their installed version and determine if an update to 4.4.8 or later is applicable.

With a CVSS score of 5.3, the relative impact is moderate, but the EPSS score of less than 1% and absence from the KEV list suggest that large‑scale exploitation is currently unlikely. Nonetheless, the attack vector is remote and can be performed by issuing a crafted HTTP request to the plugin's AJAX endpoint without authentication, allowing immediate access to the email list.