What is the CVSS score of EUVD-2026-34190?

EUVD-2026-34190 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of SP Project & Document Manager are affected by EUVD-2026-34190?

The SP Project & Document Manager WordPress plugin (versions up to 4.71) contains an unauthenticated authorization bypass that exposes all project files to remote access without credentials.

How to fix or mitigate EUVD-2026-34190?

Within 24 hours: Inventory all WordPress installations running SP Project & Document Manager ≤4.71; disable the plugin immediately or block AJAX access to the view_file handler. Within 7 days: Deploy WAF rules explicitly denying view_file AJAX requests or implement IP-based access restrictions to affected WordPress instances. Within 30 days: Monitor vendor advisory channels for patch release; if unavailable after 60 days, migrate to an alternative project management plugin with audited authorization controls.

SP Project & Document Manager EUVD-2026-34190

| CVE-2026-10737 HIGH

Missing Authorization (CWE-862)

2026-06-04 Wordfence

GHSA-7ppx-r2wh-w5w3

PHP Authentication Bypass WordPress

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 01:57 vuln.today

CVE Published

Jun 04, 2026 - 01:26 nvd

HIGH 7.5

DescriptionCVE.org

The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links for arbitrary files stored inside project folders on the server, which can contain sensitive information. The authorization gate uses a negated nonce check OR-chained with permission checks, meaning a missing or invalid nonce causes the entire condition to evaluate to true and bypass all preceding capability and ownership checks. The secondary fallback check only denies access for root-level files (pid == 0), leaving all files stored inside project folders fully exposed to unauthenticated users who supply only a valid file ID in a POST request to admin-ajax.php.

Articles & Coverage 1

infosecwriteups.com CVE-2026-10737: Unauthenticated File Disclosure in SP Project & Document Manager WordPress Plugin Jul 03, 2026

AnalysisAI

Unauthenticated information disclosure in the SP Project & Document Manager WordPress plugin (versions up to and including 4.71) allows remote attackers to enumerate file metadata and obtain download links for arbitrary files stored within project folders. The flaw stems from a broken authorization gate in the view_file AJAX handler where a negated nonce check is OR-chained with permission checks, causing the entire condition to evaluate true when no valid nonce is supplied. No public exploit identified at time of analysis, and the CVSS 7.5 score reflects confidentiality-only impact with no integrity or availability consequences.

Technical ContextAI

The vulnerability resides in the sp-client-document-manager plugin's AJAX endpoint (ajax.php and classes/ajax.php) which exposes the view_file function via WordPress's admin-ajax.php interface. The root cause is CWE-862 (Missing Authorization) implemented through a malformed boolean expression: the authorization logic uses '!wp_verify_nonce(...) || capability_check || ownership_check', so when an attacker omits or provides an invalid nonce, the negation evaluates to true and short-circuits the OR chain, bypassing both the capability and ownership checks that follow. A secondary fallback only blocks access when pid == 0 (root-level files), so any file with a non-zero parent project ID - i.e., anything stored inside an actual project folder - is reachable. The CPE cpe:2.3:a:smartypants:sp_project_&_document_manager confirms the affected vendor namespace.

RemediationAI

No vendor-released patch version is cited in the available data, so the primary action is to upgrade to any version released after 4.71 once published by smartypants - monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2eafe150-2178-4355-88a8-67687bd446e4 and the plugin's WordPress.org page for the fixed release. Until a patched version is installed, deactivate the SP Project & Document Manager plugin if the document management feature is not business-critical, accepting the loss of project file functionality. As a more targeted compensating control, place a WAF rule (such as Wordfence's managed ruleset) to block POST requests to /wp-admin/admin-ajax.php where action=sp_cdm_view_file (or the equivalent view_file action) lacks a valid authenticated session cookie, with the trade-off that legitimate logged-in client portal users must retain access. Restricting /wp-admin/admin-ajax.php to authenticated IPs is generally infeasible on public client portals and should be a last resort.