CVE-2025-12525
Published
CVSS v3
5.3
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT
Description
The Locker Content plugin for WordPress is vulnerable to Sensitive Information Exposure in version 1.0.0 via the 'lockerco_submit_post' AJAX endpoint. This makes it possible for unauthenticated attackers to extract content from posts that has been protected by the plugin.
<p><strong>Locker Content</strong> is a powerful WordPress plugin that allows you to lock your valuable content behind various engagement gates. Increase user interaction, gather user-generated content, and protect premium content with multiple locking mechanisms.</p>
<p><strong>Key Features:</strong></p>
<p>✅ <strong>Password Protection</strong> – Secure your content with password locks<br />
✅ <strong>Agreement Lock</strong> – Require users to accept terms and conditions<br />
✅ <strong>Post Creation Lock</strong> – Users must create content to unlock yours<br />
✅ <strong>GDPR Compliant</strong> – Built with privacy and data protection in mind<br />
✅ <strong>Rate Limiting</strong> – Prevent abuse with built-in rate limiting<br />
✅ <strong>Spam Protection</strong> – Advanced spam detection for user submissions<br />
✅ <strong>Responsive Design</strong> – Works perfectly on all devices<br />
✅ <strong>Admin Dashboard</strong> – Manage all submissions from one place</p>
<p><strong>Perfect For:</strong></p>
<ul>
<li><strong>Content Creators</strong> – Protect premium content and courses</li>
<li><strong>Marketers</strong> – Generate leads through content gates</li>
<li><strong>Community Sites</strong> – Encourage user participation and content creation</li>
<li><strong>Educational Sites</strong> – Require agreement to terms before accessing materials</li>
<li><strong>Membership Sites</strong> – Control access to exclusive content</li>
</ul>
<p><strong>Available Lock Types:</strong></p>
<ol>
<li><strong>Password Lock</strong> – Traditional password protection with enhanced security features</li>
<li><strong>Agreement Lock</strong> – Require users to read and agree to terms, privacy policies, or disclaimers</li>
<li><strong>Post Creation Lock</strong> – Users must submit original content to unlock your premium material</li>
</ol>
<p><strong>Security Features:</strong></p>
<ul>
<li>Password hashing for secure storage</li>
<li>Rate limiting to prevent brute force attacks</li>
<li>CSRF protection with WordPress nonces</li>
<li>Input sanitization and validation</li>
<li>IP anonymization for GDPR compliance</li>
<li>Spam detection and filtering</li>
</ul>
<p><strong>Admin Features:</strong></p>
<ul>
<li>Easy-to-use meta boxes for each post/page</li>
<li>Bulk approval/rejection of user submissions</li>
<li>Detailed submission tracking</li>
<li>Customizable messages and interface text</li>
<li>Template override support for developers</li>
</ul>
<h3>Developer Information</h3>
<p><strong>Template Override Support</strong></p>
<p>You can override plugin templates by creating files in your theme:</p>
<pre><code>your-theme/
├── lockerco/
│ ├── frontend/
│ │ ├── password-lock.php
│ │ ├── agreement-lock.php
│ │ └── postlock-lock.php
│ └── admin/
│ ├── password-fields.php
│ ├── agreement-fields.php
│ └── postlock-fields.php
</code></pre>
<p><strong>Action Hooks</strong></p>
<ul>
<li><code>lockerco_post_submitted</code> – Fires when a user submits a post through the post lock</li>
</ul>
<p><strong>Filter Hooks</strong></p>
<ul>
<li><code>lockerco_password_strength</code> – Modify password strength requirements</li>
<li><code>lockerco_spam_patterns</code> – Add custom spam detection patterns</li>
</ul>
<p><strong>CSS Classes</strong></p>
<ul>
<li><code>.lockerco-container</code> – Main container for all lock types</li>
<li><code>.password-locker</code> – Password lock specific styling</li>
<li><code>.agreement-locker</code> – Agreement lock specific styling</li>
<li><code>.postlock-locker</code> – Post creation lock specific styling</li>
</ul>
<p><strong>Security Features</strong></p>
<ul>
<li>CSRF protection with WordPress nonces</li>
<li>Input sanitization using WordPress functions</li>
<li>Rate limiting to prevent abuse</li>
<li>Password hashing for secure storage</li>
<li>IP anonymization for privacy compliance</li>
</ul>
<h3>Support</h3>
<p>For support, feature requests, or bug reports, please visit our support forum or contact us through the plugin’s official page.</p>
<p><strong>Minimum Requirements:</strong><br />
* WordPress 4.7 or higher<br />
* PHP 7.0 or higher<br />
* MySQL 5.6 or higher</p>
<p><strong>Recommended:</strong><br />
* WordPress 6.0 or higher<br />
* PHP 8.0 or higher<br />
* MySQL 8.0 or higher</p>
WordPress Plugin Directory