Read the docs
TI-2022-01422 Aliases CVE-2022-1551GHSA-qwqq-2qch-x65x

SP Project & Document Manager < 4.58 - Sensitive File Disclosure

Priority LOW 31CWE-425Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-425.

Summary

The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files.

Why it matters now

EPSS 0.00983 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed SP Project & Document Manager (Unknown): 4.58

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownSP Project & Document Managerbefore 4.584.58Patch availableCNA
  • SP Project & Document Manager VendorUnknown Affected before 4.58 Fixed in 4.58 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:smartypantsplugins:sp_project_\&_document_manager:*:*:*:*:*:wordpress:*:*before 4.58VulnerableSmartypants
  • cpe:2.3:a:smartypantsplugins:sp_project_\&_document_manager:*:*:*:*:*:wordpress:*:* Versions before 4.58 Vulnerable ·Smartypants

Remediation

  • Fix · CNA SP Project & Document Manager (Unknown) Fixed in 4.58

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-1551
  2. 2026-10-03 Alias added: GHSA-qwqq-2qch-x65x

References

Exploit 1

  • TI-2021-06639 SP Project & Document Manager <2 4.22 - Authenticated Shell Upload CVSS 3.1HIGH 8.8
  • TI-2024-03494 SP Project & Document Manager <= 4.71 - Data Update via IDOR CVSS 3.1MEDIUM 6.5
  • TI-2024-03495 SP Project & Document Manager <= 4.71 - Subscriber+ File Download via IDOR CVSS 3.1MEDIUM 6.5
  • TI-2023-18492 WordPress SP Project & Document Manager Plugin <= 4.67 is vulnerable to SQL Injection CVSS 3.1HIGH 8.8
  • TI-2023-02869 Authorization bypass in Smartypants SP Project & Document Manager CVSS 3.1HIGH 8.8
  • TI-2021-03086 SP Project & Document Manager < 4.24 - Subscriber+ Shell Upload CVSS 3.1HIGH 8.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences