The plugin allows exporting data to CSV files that contain emails, IP addresses, usernames, role information, and location data. These files are stored in a publicly accessible directory using predictable filenames. An attacker who does not need authentication can download the CSV and gain sensitive user information, which can be used for phishing, credential harvesting, or other attacks.

The vulnerability affects the WordPress plugin Secure Copy Content Protection and Content Locking, versions 4.9.2 and earlier. The plugin is distributed by ays-pro.

CVSS score of 5.3 indicates a medium severity vulnerability. The EPSS score of less than 1% shows that exploitation is considered unlikely at present. It is not listed in the CISA KEV catalog, so no confirmed widespread exploitation is known. However, because access to the CSV files is unauthenticated and the files are placed in a public folder, an attacker can obtain the data by simply visiting the file URL, without needing to exploit any code or perform further actions.