CVE-2021-24931

What it actually does

CVE-2021-24931 is an unauthenticated SQL injection in the Secure Copy Content Protection and Content Locking WordPress plugin before version 2.8.2. The vulnerable AJAX action, ays_sccp_results_export_file, accepts the sccp_id parameter and uses it in a SQL query without proper escaping or parameterization. Because the AJAX action is reachable by unauthenticated users, a remote attacker can inject SQL through HTTP requests to WordPress admin-ajax.php. Successful exploitation can allow database reads, modification or deletion of data, authentication bypass via credential/hash extraction, creation or modification of administrator accounts, and in some configurations may support further compromise of the WordPress application.

Why it matters to the business

A vulnerable public WordPress site can be compromised without a valid login. Attackers may steal user data, extract password hashes, alter site content, create administrative access, damage site availability, or pivot from the WordPress database into broader application compromise. The CVSS score is critical, EPSS is high at 0.78812, and exploit maturity is weaponized, so internet-facing sites using this plugin should be treated as high-priority remediation targets even though this CVE is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies a WordPress site running the Secure Copy Content Protection and Content Locking plugin. They then send crafted requests to /wp-admin/admin-ajax.php using the action ays_sccp_results_export_file and a malicious sccp_id value. Because the plugin fails to safely escape the parameter before inserting it into a SQL statement, the database interprets attacker-controlled input as SQL syntax. The attacker can use boolean-based, error-based, or time-based SQL injection techniques to confirm the flaw, enumerate database structure, extract sensitive records such as WordPress user accounts and password hashes, and potentially alter database contents. With sufficient data access, the attacker may add an administrator user, reset credentials, plant malicious content, deploy a web shell through the WordPress admin interface, or use the compromised site for spam, phishing, malware hosting, or further attacks.

How to fix it

Upgrade the Secure Copy Content Protection and Content Locking WordPress plugin to version 2.8.2 or later. If an upgrade is not immediately possible, disable and remove the plugin until it can be safely updated. Restrict access to /wp-admin/admin-ajax.php only where operationally feasible, though this may affect normal WordPress functionality and should not be considered a complete fix. Deploy a web application firewall rule to block requests to action=ays_sccp_results_export_file containing SQL metacharacters, UNION queries, comments, stacked queries, or time-delay functions. After patching, review WordPress administrator accounts, rotate credentials for privileged users, and consider resetting passwords if database disclosure is suspected.

How to confirm the fix worked

Confirm the installed plugin version is 2.8.2 or later from the WordPress administrative plugin page, filesystem plugin metadata, or WordPress CLI. Using WP-CLI, list plugins and verify that the Secure Copy Content Protection and Content Locking plugin is updated or inactive. Review web server access logs to ensure no ongoing requests are reaching /wp-admin/admin-ajax.php with action=ays_sccp_results_export_file and suspicious sccp_id payloads. If using a vulnerability scanner, run an authenticated WordPress plugin inventory scan and verify the finding is closed. Do not validate by running destructive SQL injection payloads against production; use a staging copy or a safe scanner check.

Typical attack path

1. Scan public WordPress sites for the Secure Copy Content Protection and Content Locking plugin or its exposed assets.
2. Send probing requests to /wp-admin/admin-ajax.php with action=ays_sccp_results_export_file and crafted sccp_id values.
3. Confirm SQL injection using response differences, SQL errors, or time-delay payloads such as SLEEP().
4. Enumerate database names, table names, and WordPress user records.
5. Extract sensitive data, including usernames, emails, password hashes, session-related data, or plugin/application data.
6. Use database write capability, if available, to modify WordPress options, create an administrator account, or tamper with content.
7. Log in or otherwise gain application control and deploy persistence such as malicious plugins, modified theme files, or web shells.
8. Use the compromised site for data theft, defacement, spam, phishing, malware distribution, or further infrastructure compromise.

How to detect it

To determine whether exploitation already occurred, review HTTP access logs from web servers, load balancers, CDNs, reverse proxies, and WAFs for requests to /wp-admin/admin-ajax.php where the action parameter equals ays_sccp_results_export_file. Focus on sccp_id values containing SQL injection patterns such as single quotes, double quotes, URL-encoded quotes, UNION SELECT, SELECT FROM, information_schema, SLEEP(), BENCHMARK(), OR 1=1, SQL comments, or unusually long encoded payloads. Investigate HTTP 200 responses, 500 errors, abnormal response sizes, repeated requests with varying sccp_id payloads, and requests from the same source using time-delay probes. Correlate suspicious requests with WordPress authentication logs, creation of new administrator users, modified plugin/theme files, unexpected PHP files under wp-content, changes to wp_options, and outbound connections from the web server. Also review database logs, if available, for anomalous SELECT, UNION, or time-delay statements referencing WordPress tables around the same timestamps.

• /wp-admin/admin-ajax.php?action=ays_sccp_results_export_file
• action=ays_sccp_results_export_file
• ays_sccp_results_export_file
• sccp_id=
• sccp_id=%27
• sccp_id='
• sccp_id=%22
• sccp_id="
• UNION SELECT
• union select
• information_schema
• SLEEP(
• sleep(
• BENCHMARK(
• benchmark(
• OR 1=1
• or 1=1
• --
• %2D%2D
• /*
• %2F%2A
• wp-content/plugins/secure-copy-content-protection
• wp-content/plugins/secure-copy-content-protection/secure-copy-content-protection.php

What your security team should do

• Immediately inventory WordPress sites for the Secure Copy Content Protection and Content Locking plugin, prioritizing internet-facing instances.
• Upgrade affected plugin installations to version 2.8.2 or later, or disable/remove the plugin where no fixed version can be confirmed.
• Search historical web server, CDN, WAF, and reverse proxy logs for exploitation attempts against admin-ajax.php using action=ays_sccp_results_export_file.
• Prioritize incident review for sites where suspicious sccp_id values include SQL keywords, quote characters, comments, UNION SELECT, information_schema, or time-delay functions.
• Review WordPress administrator users, recently modified plugins/themes, unexpected uploads, and database changes for signs of post-exploitation activity.
• Rotate WordPress administrator passwords and database credentials if exploitation is suspected or confirmed.
• Add WAF/SIEM detections for the vulnerable AJAX action and common SQL injection payload patterns.
• Ensure regular backups are available and test restoration procedures for affected WordPress sites.