Secure Copy Content Protection and Content Locking < 2.6.7 - Authenticated Blind SQL Injections
Priority LOW 34CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
Why it matters now
EPSS 0.01344 71st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Secure Copy Content Protection and Content Locking (Ays Pro): 2.6.7
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Ays Pro | Secure Copy Content Protection and Content Locking | 2.6.7 to before 2.6.7 | 2.6.7 | Patch available | CNA |
- Secure Copy Content Protection and Content Locking VendorAys Pro Affected 2.6.7 to before 2.6.7 Fixed in 2.6.7 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ays-pro:secure_copy_content_protection_and_content_locking:*:*:*:*:*:wordpress:*:* | before 2.6.7 | Vulnerable | Ays Pro |
- cpe:2.3:a:ays-pro:secure_copy_content_protection_and_content_locking:*:*:*:*:*:wordpress:*:* Versions before 2.6.7 Vulnerable ·Ays Pro
Remediation
- Fix · CNA Secure Copy Content Protection and Content Locking (Ays Pro) Fixed in 2.6.7
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24484
- 2026-10-03 Alias added: GHSA-4mw6-mpc3-jcw5
References
More Ays Pro Secure Copy Content Protection And Content Locking vulnerabilities
- TI-2021-07210 Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL Injection CVSS 3.1CRITICAL 9.8
- TI-2024-05688 Secure Copy Content Protection < 4.0.9 - Admin+ Stored XSS CVSS 3.1MEDIUM 6.5
- TI-2024-06389 Secure Copy Content Protection and Content Locking < 4.1.7 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
- TI-2024-06388 Secure Copy Content Protection and Content Locking < 4.1.7 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
Sources
- CVE-2021-24484 · CVE Program
- CVE-2021-24484 · NVD
- FIRST EPSS
- GHSA-4mw6-mpc3-jcw5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences