High severity · published Aug 2, 2021
CVE-2021-24484
Secure Copy Content Protection and Content Locking < 2.6.7 - Authenticated Blind SQL Injections
7.2
CVSS
1.3%
EPSS
No
On KEV
Description
The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Secure Copy Content Protection and Content Locking · Ays Pro
2.6.7 before 2.6.7 · source: vendor, NVD
Affected product
SC
Secure Copy Content Protection and Content Locking
Ays Pro
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24484
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24484
Exploit
https://wpscan.com/vulnerability/9ce0153d-4a8b-4215-b6b6-15ca68c4f52c
More from Secure Copy Content Protection and Content Locking
9.8
CVE-2021-24931
Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL Injection
7.2
CVE-2026-1320
Secure Copy Content Protection and Content Locking <= 4.9.8 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header
7.1
CVE-2025-30905
WordPress Secure Copy Content Protection and Content Locking plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability
7.1
CVE-2024-47306
WordPress Secure Copy Content Protection and Content Locking plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability
6.4
CVE-2026-2367
Secure Copy Content Protection and Content Locking <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute