CVE-2026-10737: WordPress SP Project & Document Manager Unauthenticated File Access Vulnerability

Technical summary

CVE-2026-10737 is an authorization bypass in the SP Project & Document Manager WordPress plugin affecting all versions through 4.71. The view_file function implements a negated nonce check OR-chained with permission checks, creating a logic error: when a nonce is missing or invalid, the negation evaluates to true, short-circuiting the entire condition and bypassing downstream capability and ownership checks. A secondary fallback check only denies access to root-level files (pid == 0), leaving all files stored inside project folders accessible to unauthenticated attackers via POST requests to admin-ajax.php using only a valid file ID. This affects the confidentiality of stored files and metadata, with no integrity or availability impact.

Business impact

Organizations using this plugin to manage sensitive project documentation face direct exposure of confidential materials. An attacker could systematically enumerate file IDs to extract customer data, financial records, legal documents, source code, or architectural plans without detection. The lack of authentication means there is no audit trail of unauthorized access. For managed service providers, consultancies, and enterprises relying on this plugin for client project storage, this vulnerability creates significant compliance and liability risks, particularly under GDPR, HIPAA, or SOC 2 frameworks where unauthorized data access must be reported.

Affected systems

All WordPress installations running the SP Project & Document Manager plugin version 4.71 or earlier are affected. The plugin is deployed on any WordPress site where users upload files to project folders. The vulnerability is network-accessible and requires no special configuration—it affects standard WordPress admin-ajax.php endpoints present on all affected deployments. Sites with public-facing project folders are at highest immediate risk.

Exploitability

This vulnerability is straightforward to exploit. An attacker requires only network access to the WordPress installation and knowledge of a valid file ID—neither authentication nor a user account is required. The exploit path is simple: a POST request to admin-ajax.php with an action parameter pointing to the vulnerable function and a file ID yields file metadata and download links. No special tools, elaborate payloads, or user interaction are needed. The low complexity and lack of authentication requirements classify this as highly exploitable. Active exploitation is likely once the vulnerability is widely publicized.

Remediation

Immediately update the SP Project & Document Manager plugin to a version that implements proper capability checks and corrects the authorization logic. Do not rely on nonce checks alone; capability checks must precede and be enforced independently of nonce validation. Verify that the patched version performs explicit permission validation before granting access to any file, regardless of whether a nonce is present. As an interim mitigation, restrict access to admin-ajax.php via Web Application Firewall rules or network controls to reduce the attack surface, though this is not a complete remediation.

Patch guidance

Consult the official SP Project & Document Manager plugin repository and the vendor's security advisory for the recommended patched version. Update immediately through the WordPress admin interface or directly from the plugin source. After patching, clear any cached authentication tokens or sessions to force re-validation. Perform a spot-check by attempting to access file resources as an unauthenticated user to confirm the vulnerability is resolved. Verify that file access now properly enforces user authentication and ownership checks.

Detection guidance

Monitor web server and application logs for POST requests to admin-ajax.php containing actions related to file retrieval or viewing. Look for requests from non-authenticated sources (no valid session cookie) attempting to access file metadata or download endpoints. Establish baseline patterns of legitimate admin-ajax.php traffic and alert on anomalies such as requests with suspicious file IDs or rapid enumeration attempts. If forensic analysis is needed, check WordPress database logs and file system access logs for unauthorized file reads during the vulnerable period. Consider enabling detailed logging on the plugin if available to capture which files were accessed by whom and when.

Why prioritize this

This vulnerability scores HIGH (CVSS 7.5) and should receive immediate attention because it enables unauthenticated information disclosure of potentially sensitive project files with no barriers to exploitation. The lack of authentication requirements, network accessibility, and high impact on confidentiality make this a priority for rapid patching. Organizations should treat this as urgent if they store confidential materials in project folders managed by this plugin. The absence from CISA's KEV catalog does not diminish the urgency; active exploitation is likely once public awareness increases.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects: Network vector (AV:N) - remotely exploitable over the internet; Low complexity (AC:L) - no special conditions or user interaction required; No privileges needed (PR:N) - unauthenticated access; No scope change (S:U) - impact limited to the plugin's files; High confidentiality impact (C:H) - arbitrary file metadata and download links exposed; No integrity or availability impact (I:N/A:N). The high score underscores the serious risk to data confidentiality and the ease of exploitation. Organizations should not discount this vulnerability due to absence from known exploit databases; the simplicity of the attack and broad plugin distribution suggest rapid weaponization is probable.

Frequently asked questions