CVE-2025-14159 is a CSRF vulnerability in the ays-pro Secure Copy Content Protection and Content Locking WordPress plugin (up to version 4.9.2). The vulnerability arises from missing nonce validation on the 'ays_sccp_results_export_file' AJAX action, allowing attackers to forge requests that cause site administrators to export sensitive user data. The exported data is stored in a publicly accessible file, exposing sensitive information such as email addresses, IP addresses, physical addresses, and user IDs to unauthenticated attackers. The vulnerability is rated medium severity with a CVSS 3.1 score of 4.3. There is no vendor advisory or patch link provided, so patch status is not confirmed.

An attacker can exploit this vulnerability by tricking a site administrator into performing an action that triggers the export of sensitive plugin data. The data includes email addresses, IP addresses, physical addresses, user IDs, and other user information. Since the exported file is publicly accessible, attackers can retrieve this sensitive information without authentication. This results in a confidentiality breach of user data. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on suspicious links and consider restricting access to the export functionality if possible. Monitoring for unusual export activity may help detect exploitation attempts. No official fix or temporary workaround is currently documented.