CVE-2025-14442 describes a vulnerability in the ays-pro Secure Copy Content Protection and Content Locking WordPress plugin where exported CSV files containing sensitive user data are stored in a publicly accessible directory with predictable filenames. This misconfiguration allows unauthenticated remote attackers to access sensitive information including emails, IP addresses, usernames, roles, and location data by directly requesting these files. The vulnerability affects all versions up to and including 4.9.2. The CVSS 3.1 base score is 5.3, reflecting a medium severity information disclosure risk with no required privileges or user interaction.

Sensitive user information such as emails, IP addresses, usernames, roles, and location data can be exposed to unauthenticated attackers due to publicly accessible exported CSV files. This exposure can lead to privacy violations and potential targeted attacks based on the leaked data. There is no indication of impact on data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the directory where exported CSV files are stored, for example by implementing web server access controls or moving exported files to non-public locations. Monitoring for unauthorized access to these files is also recommended.