The Secure Copy Content Protection and Content Locking plugin contains a missing nonce check on the ‘ays_sccp_results_export_file’ AJAX action, allowing attackers to exploit a cross‑site request forgery weakness. When a site administrator clicks a malicious link, the attacker can trigger a data export without authentication. The exported file contains email addresses, IP addresses, physical addresses, user IDs, and other sensitive information which is then stored in a publicly accessible location, leading to a confidentiality breach. The weakness is identified as CWE‑352.

All installations of the Secure Copy Content Protection and Content Locking plugin produced by ays-pro that run WordPress plugin versions up to and including 4.9.2 are affected. Versions 4.9.3 and higher contain the fix, while the 4.8.7 release exhibits the same issue as part of the same code path.

The CVSS score is 4.3, indicating moderate overall risk, and the EPSS score is below 1 %, suggesting the probability of exploitation remains low. The vulnerability is not listed in the CISA KEV catalog. Exploitability requires a forged request, which needs the cooperation of an authenticated site administrator who unknowingly performs the export action. Once triggered, the publicly available file delivers the sensitive data directly to the attacker, providing a direct avenue for information theft.