CVE-2025-1404 Overview
CVE-2025-1404 affects the Secure Copy Content Protection and Content Locking plugin for WordPress. The vulnerability exists in the ays_sccp_reports_user_search() function, which lacks a capability check. All versions up to and including 4.4.7 are affected. Unauthenticated attackers can invoke the function over the network to retrieve a list of registered user email addresses. The flaw is classified as Missing Authorization [CWE-862] and carries a CVSS score of 5.3. The issue was resolved in the plugin release tracked by WordPress changeset #3246301.
Critical Impact
Unauthenticated attackers can enumerate registered user email addresses from any WordPress site running a vulnerable version of the plugin, enabling targeted phishing and credential stuffing campaigns.
Affected Products
- Secure Copy Content Protection and Content Locking plugin for WordPress
- All versions up to and including 4.4.7
- Sites running the vulnerable plugin regardless of WordPress core version
Discovery Timeline
- 2025-03-01 - CVE-2025-1404 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-1404
Vulnerability Analysis
The Secure Copy Content Protection and Content Locking plugin exposes an AJAX action handled by the ays_sccp_reports_user_search() function. The function returns user records, including registered email addresses, when queried. The handler does not verify the caller's capability or authentication state before returning data. Any anonymous HTTP request that reaches the AJAX endpoint can therefore harvest user email addresses. Because the data is limited to email enumeration, the impact is scoped to confidentiality without integrity or availability effects.
Root Cause
The root cause is a missing authorization check [CWE-862] in the ays_sccp_reports_user_search() function located in admin/class-secure-copy-content-protection-admin.php. The function was designed for administrative reporting features but was registered as an AJAX action reachable by unauthenticated visitors. The developer omitted a current_user_can() capability guard and an accompanying nonce verification. As a result, the endpoint treats anonymous callers the same as authorized administrators.
Attack Vector
Exploitation requires only network access to the WordPress site. An attacker sends a crafted POST request to the WordPress admin-ajax.php endpoint targeting the plugin's user search action. The response contains registered user emails matching the search parameter. Attackers can iterate through the alphabet or common name fragments to enumerate the full user base. Collected email addresses feed downstream campaigns such as spear phishing, credential stuffing against wp-login.php, and account takeover attempts against reused credentials. See the Wordfence Vulnerability Report and the WordPress Plugin Code Snippet for technical detail.
Detection Methods for CVE-2025-1404
Indicators of Compromise
- Unauthenticated POST requests to /wp-admin/admin-ajax.php with an action parameter referencing ays_sccp_reports_user_search.
- High volumes of AJAX requests from a single source containing sequential or dictionary-style search parameters.
- Web server access logs showing repeated 200 responses to the plugin's AJAX action from anonymous sessions.
Detection Strategies
- Inspect WordPress access logs for admin-ajax.php requests without an authenticated session cookie targeting the vulnerable action.
- Correlate email enumeration attempts with subsequent brute-force logins against wp-login.php from the same IP range.
- Deploy web application firewall rules that block or rate-limit anonymous calls to plugin-specific AJAX actions.
Monitoring Recommendations
- Enable verbose logging on the WordPress reverse proxy or WAF and forward events to a central log store for retention.
- Alert on any successful anonymous invocation of ays_sccp_reports_user_search after patching, as it indicates rollback or reintroduction.
- Track outbound phishing reports naming registered users to identify email lists sourced from a scraped site.
How to Mitigate CVE-2025-1404
Immediate Actions Required
- Update the Secure Copy Content Protection and Content Locking plugin to the version released after 4.4.7 that includes the fix from changeset #3246301.
- Audit WordPress user accounts and rotate credentials for accounts that reuse passwords across services.
- Review web server logs for prior exploitation and notify affected users if enumeration is confirmed.
Patch Information
The vendor addressed the missing capability check in WordPress Changeset #3246301. Administrators should upgrade through the WordPress plugin dashboard or via WP-CLI. See the WordPress Plugin Developer Info page for the latest release notes.
Workarounds
- Deactivate and remove the plugin until an upgrade can be scheduled if the reporting feature is not required.
- Restrict access to /wp-admin/admin-ajax.php for unauthenticated users at the WAF or reverse proxy layer where feasible.
- Add a WAF signature that blocks POST bodies containing action=ays_sccp_reports_user_search from anonymous sources.
# Configuration example: upgrade the plugin using WP-CLI
wp plugin update secure-copy-content-protection
wp plugin get secure-copy-content-protection --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
