EUVD-2026-34190
GHSA-7ppx-r2wh-w5w3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFingerprint WordPress site running plugin
-
DeliveryEnumerate file IDs via admin-ajax.php
-
ExploitSend POST to view_file action without nonce
-
ExecutionBypass OR-chained authorization gate
-
PersistReceive file metadata and download URL
-
ImpactDownload sensitive project documents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that the target WordPress site has the SP Project & Document Manager plugin installed and activated at version 4.71 or earlier, and that at least one file has been uploaded into a project folder (pid != 0) - files stored at the root level (pid == 0) are protected by the secondary fallback check and are NOT exploitable via this path. The attacker needs network reachability to /wp-admin/admin-ajax.php and must supply a valid file ID in a POST request; no authentication, no user interaction, no nonce, and no non-default configuration are required (CVSS PR:N/UI:N/AC:L). Limiting factors: impact is confined to file metadata and download URL disclosure (C:H, I:N, A:N) rather than write access or RCE, and successful data harvesting depends on the existence of sensitive content in project folders. |
| Impact | The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N accurately describes a network-reachable, unauthenticated, low-complexity confidentiality-only flaw - exactly the profile of a mass-scannable information disclosure issue against WordPress sites. The vulnerability is not currently listed in CISA KEV and no public exploit has been identified at time of analysis, but the trivial exploitation path (a single POST to admin-ajax.php with a guessable integer file ID) and Wordfence's public disclosure significantly raises the probability of automated exploitation against the WordPress plugin install base. EPSS data was not provided in the input so quantitative exploitation probability cannot be cited. Real-world risk is meaningful where the plugin is used to store client documents, contracts, PII, or other sensitive material, but is limited to disclosure of file metadata and download URLs rather than full system compromise. |
| Exploit ScenarioDerived | An attacker enumerates WordPress sites running the SP Project & Document Manager plugin via fingerprinting, then sends a single unauthenticated POST request to /wp-admin/admin-ajax.php specifying the view_file action and incrementing integer file IDs. The server responds with file metadata and a download URL for each valid ID whose parent project ID is non-zero, allowing the attacker to harvest client contracts, invoices, identity documents, or any other materials stored inside project folders. No public exploit was identified at time of analysis, but the request shape is trivially derivable from the disclosed source-code references. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 04, 2026
Unauthenticated information disclosure in the SP Project & Document Manager WordPress plugin (versions up to and including 4.71) allows remote attackers to enumerate file metadata and obtain download links for arbitrary files stored within project folders. The flaw stems from a broken authorization gate in the view_file AJAX handler where a negated nonce check is OR-chained with permission checks, causing the entire condition to evaluate true when no valid nonce is supplied. No public exploit identified at time of analysis, and the CVSS 7.5 score reflects confidentiality-only impact with no integrity or availability consequences.
RemediationAI
No vendor-released patch version is cited in the available data, so the primary action is to upgrade to any version released after 4.71 once published by smartypants - monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2eafe150-2178-4355-88a8-67687bd446e4 and the plugin's WordPress.org page for the fixed release. Until a patched version is installed, deactivate the SP Project & Document Manager plugin if the document management feature is not business-critical, accepting the loss of project file functionality. As a more targeted compensating control, place a WAF rule (such as Wordfence's managed ruleset) to block POST requests to /wp-admin/admin-ajax.php where action=sp_cdm_view_file (or the equivalent view_file action) lacks a valid authenticated session cookie, with the trade-off that legitimate logged-in client portal users must retain access. Restricting /wp-admin/admin-ajax.php to authenticated IPs is generally infeasible on public client portals and should be a last resort.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the sp-client-document-manager plugin's AJAX endpoint (ajax.php and classes/ajax.php) which exposes the view_file function via WordPress's admin-ajax.php interface. The root cause is CWE-862 (Missing Authorization) implemented through a malformed boolean expression: the authorization logic uses '!wp_verify_nonce(...) || capability_check || ownership_check', so when an attacker omits or provides an invalid nonce, the negation evaluates to true and short-circuits the OR chain, bypassing both the capability and ownership checks that follow. A secondary fallback only blocks access when pid == 0 (root-level files), so any file with a non-zero parent project ID - i.e., anything stored inside an actual project folder - is reachable. The CPE cpe:2.3:a:smartypants:sp_project_&_document_manager confirms the affected vendor namespace.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links for arbitrary files stored inside project folders on the server, which can contain sensitive information. The authorization gate uses a negated nonce check OR-chained with permission checks, meaning a missing or invalid nonce causes the entire condition to evaluate to true and bypass all preceding capability and ownership checks. The secondary fallback check only denies access for root-level files (pid == 0), leaving all files stored inside project folders fully exposed to unauthenticated users who supply only a valid file ID in a POST request to admin-ajax.php.
Articles & Coverage 1
Executive ViewAI
The SP Project & Document Manager WordPress plugin (versions up to 4.71) contains an unauthenticated authorization bypass that exposes all project files to remote access without credentials. Organizations relying on this plugin for storing contracts, designs, financial records, or other sensitive project materials face immediate risk of data disclosure. No vendor patch is currently available, necessitating urgent mitigation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable the plugin entirely until patch availability; (2) Implement WAF rules blocking view_file AJAX endpoint requests; (3) Restrict plugin access via network-level IP whitelisting; (4) Deploy reverse-proxy authentication layer in front of WordPress; (5) Enable detailed access logging on affected file directories for incident detection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB