# CVE-2021-24931: Secure Copy Content Protection and Content Locking WordPress plugin - SQLi

> Live exploitation tracking for CVE-2021-24931 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-24931

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Ays Pro Secure Copy Content Protection and Content Locking
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** cms, wordpress

## Description

The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection.

## CrowdSec analysis

[CVE-2021-24931](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-24931) is a critical vulnerability in the Secure Copy Content Protection and Content Locking WordPress plugin that allows unauthenticated SQL injection through improper handling of input parameters in an AJAX action.

CrowdSec has been tracking this vulnerability and its exploits since 5th of February 2025.

CrowdSec network data shows that most actors exploiting CVE-2021-24931 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
In addition, according to the CrowdSec network, attack volume against CVE-2021-24931 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Observed attacks commonly focus on requests involving the `/wp-admin/admin-ajax.php` endpoint with an export-related action.

## Timeline

- 2021-12-06: CVE Published. CVE-2021-24931 is published to NVD.
- 2025-02-05: Rule Released. CrowdSec releases a rule to detect CVE-2021-24931 exploitation attempts against the CrowdSec Network.
- 2025-02-06: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-24931 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24931.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-24931) follows observed exploitation activity for CVE-2021-24931. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.