Missing authorization in Smartypants SP Project & Document Manager
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links for arbitrary files stored inside project folders on the server, which can contain sensitive information. The authorization gate uses a negated nonce check OR-chained with permission checks, meaning a missing or invalid nonce causes the entire condition to evaluate to true and bypass all preceding capability and ownership checks. The secondary fallback check only denies access for root-level files (pid == 0), leaving all files stored inside project folders fully exposed to unauthenticated users who supply only a valid file ID in a POST request to admin-ajax.php.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Smartypants | SP Project & Document Manager | up to 4.71 | — | No fix listed | CNA |
- SP Project & Document Manager VendorSmartypants Affected up to 4.71 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:smartypantsplugins:sp_project_\&_document_manager:*:*:*:*:*:*:*:* | — | — | Smartypants |
- cpe:2.3:a:smartypantsplugins:sp_project_\&_document_manager:*:*:*:*:*:*:*:* Versions — — ·Smartypants
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-10737
- 2026-10-03 Alias added: GHSA-7ppx-r2wh-w5w3
References
Other 4
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2eafe150-2178-4355-88a8-67687bd446e4?source=cve
- https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/classes/ajax.php#L250
- https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/ajax.php#L39
- https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/ajax.php#L155
More Smartypants vulnerabilities
- TI-2021-06639 SP Project & Document Manager <2 4.22 - Authenticated Shell Upload CVSS 3.1HIGH 8.8
- TI-2024-03494 SP Project & Document Manager <= 4.71 - Data Update via IDOR CVSS 3.1MEDIUM 6.5
- TI-2024-03495 SP Project & Document Manager <= 4.71 - Subscriber+ File Download via IDOR CVSS 3.1MEDIUM 6.5
- TI-2021-15931 SP Rental Manager <= 1.5.3 Unauthenticated SQL Injection CVSS 3.1HIGH 8.2
- TI-2023-18492 WordPress SP Project & Document Manager Plugin <= 4.67 is vulnerable to SQL Injection CVSS 3.1HIGH 8.8
- TI-2023-02869 Authorization bypass in Smartypants SP Project & Document Manager CVSS 3.1HIGH 8.8
Sources
- CVE-2026-10737 · CVE Program
- CVE-2026-10737 · NVD
- FIRST EPSS
- GHSA-7ppx-r2wh-w5w3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences