Junglewise Threat Intelligence

CVE-2026-10737: SmartyPants SP Project & Document Manager missing authorization in view_file

CVE-2026-10737 · Severity: high · CVSS 7.5 · Published 2026-06-04

Executive brief

The SP Project & Document Manager plugin for WordPress, which is used to manage and share files within projects, contains a security flaw that allows unauthorized access to stored documents. An unauthenticated attacker can exploit this to view file details and obtain download links for sensitive files stored on the server. This could lead to the exposure of confidential business documents, project data, and other private information.

Technical details

A missing authorization check (CWE-862) exists in the view_file function of the SP Project & Document Manager plugin for WordPress. The vulnerability stems from an authorization gate that uses a negated nonce check OR-chained with permission checks; consequently, providing an invalid or missing nonce causes the entire condition to evaluate as true, bypassing capability and ownership verification. While a fallback check exists, it only restricts access to root-level files, leaving all files within project folders accessible. An unauthenticated attacker can exploit this by sending a crafted POST request to admin-ajax.php with a valid file ID to retrieve metadata and download links.

Affected products

  • SmartyPants SP Project & Document Manager up to, and including, 4.71

Timeline

  • 2026-06-04: disclosed: Vulnerability published in NVD

References