CVE-2021-24931 – This vulnerability allows attackers to execute ... (How to Fix)

Q: What is the severity of CVE-2021-24931?

CVE-2021-24931 has a CVSS score of 9.8 (CRITICAL). This vulnerability allows attackers to execute arbitrary SQL commands on WordPress sites running the Secure Copy Content Protection and Content Locking plugin. Both unauthenticated and authenticated users can exploit it via the ays_sccp_results_export_file AJAX action. This affects all WordPress installations with vulnerable plugin versions.

📋 TL;DR

This vulnerability allows attackers to execute arbitrary SQL commands on WordPress sites running the Secure Copy Content Protection and Content Locking plugin. Both unauthenticated and authenticated users can exploit it via the ays_sccp_results_export_file AJAX action. This affects all WordPress installations with vulnerable plugin versions.

💻 Affected Systems

Products:

WordPress Secure Copy Content Protection and Content Locking plugin

Versions: All versions before 2.8.2

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability exists in default plugin configuration. No special configuration required for exploitation.

📦 What is this software?

Secure Copy Content Protection And Content Locking by Ays Pro

View all CVEs affecting Secure Copy Content Protection And Content Locking →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise leading to data theft, privilege escalation, and potential remote code execution via database functions.

🟠

Likely Case

Data extraction from WordPress database including user credentials, sensitive content, and plugin data.

🟢

If Mitigated

Limited impact with proper input validation and parameterized queries in place.

🌐 Internet-Facing: HIGH - Exploitable by unauthenticated users over the internet via AJAX endpoints.

🏢 Internal Only: MEDIUM - Still exploitable by authenticated users but requires some level of access.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Public exploit code available on Packet Storm Security. Simple SQL injection via sccp_id parameter.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.8.2

Vendor Advisory: https://wordpress.org/plugins/secure-copy-content-protection/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Secure Copy Content Protection and Content Locking'. 4. Click 'Update Now' if available. 5. Alternatively, download version 2.8.2+ from WordPress repository and manually update.

🔧 Temporary Workarounds

Disable vulnerable AJAX endpoint

all

Remove or restrict access to the ays_sccp_results_export_file AJAX action

Add to theme's functions.php or custom plugin: remove_action('wp_ajax_ays_sccp_results_export_file', 'ays_sccp_results_export_file'); remove_action('wp_ajax_nopriv_ays_sccp_results_export_file', 'ays_sccp_results_export_file');

Web Application Firewall rule

all

Block SQL injection patterns targeting sccp_id parameter

WAF-specific configuration to block: *?action=ays_sccp_results_export_file*sccp_id=*[SQL injection patterns]*

🧯 If You Can't Patch

Disable the Secure Copy Content Protection and Content Locking plugin immediately
Implement strict input validation and sanitization for all user-supplied parameters in custom code

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for 'Secure Copy Content Protection and Content Locking' version number

Check Version:

wp plugin list --name='secure-copy-content-protection' --field=version (if WP-CLI installed)

Verify Fix Applied:

Confirm plugin version is 2.8.2 or higher in WordPress admin panel

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to /wp-admin/admin-ajax.php with action=ays_sccp_results_export_file
SQL error messages in WordPress debug logs containing sccp_id parameter

Network Indicators:

HTTP POST requests with SQL injection patterns in sccp_id parameter
Multiple rapid requests to admin-ajax.php endpoint

SIEM Query:

source="wordpress.log" AND "ays_sccp_results_export_file" AND ("SQL" OR "syntax" OR "union" OR "select" OR "sleep(")

📊 Metadata

CVE ID: CVE-2021-24931

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

Published: December 6, 2021

Last Updated: November 21, 2024

🔗 References

http://packetstormsecurity.com/files/165946/WordPress-Secure-Copy-Content-Protection-And-Content-Locking-2.8.1-SQL-Injection.html Exploit,Third Party Advisory,VDB Entry
https://wpscan.com/vulnerability/1cd52d61-af75-43ed-9b99-b46c471c4231 Exploit,Third Party Advisory
http://packetstormsecurity.com/files/165946/WordPress-Secure-Copy-Content-Protection-And-Content-Locking-2.8.1-SQL-Injection.html Exploit,Third Party Advisory,VDB Entry
https://wpscan.com/vulnerability/1cd52d61-af75-43ed-9b99-b46c471c4231 Exploit,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-24931, you might also want to check these: