CVE-2026-10737

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10737", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-06-03T13:00:59.355Z", "datePublished": "2026-06-04T01:26:44.640Z", "dateUpdated": "2026-06-04T12:53:04.020Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-06-04T01:26:44.640Z"}, "affected": [{"vendor": "smartypants", "product": "SP Project & Document Manager", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.71", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links for arbitrary files stored inside project folders on the server, which can contain sensitive information. The authorization gate uses a negated nonce check OR-chained with permission checks, meaning a missing or invalid nonce causes the entire condition to evaluate to true and bypass all preceding capability and ownership checks. The secondary fallback check only denies access for root-level files (pid == 0), leaving all files stored inside project folders fully exposed to unauthenticated users who supply only a valid file ID in a POST request to admin-ajax.php."}], "title": "SP Project & Document Manager <= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view_file() Function", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2eafe150-2178-4355-88a8-67687bd446e4?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/classes/ajax.php#L250"}, {"url": "https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/ajax.php#L39"}, {"url": "https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/ajax.php#L155"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "NamDang"}], "timeline": [{"time": "2026-06-03T13:01:35.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-04T12:52:52.947406Z", "id": "CVE-2026-10737", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T12:53:04.020Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10737", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T12:52:52.947406Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T12:52:57.325Z"}}], "cna": {"title": "SP Project & Document Manager <= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view_file() Function", "credits": [{"lang": "en", "type": "finder", "value": "NamDang"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "smartypants", "product": "SP Project & Document Manager", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.71"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-06-03T13:01:35.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2eafe150-2178-4355-88a8-67687bd446e4?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/classes/ajax.php#L250"}, {"url": "https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/ajax.php#L39"}, {"url": "https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/ajax.php#L155"}], "descriptions": [{"lang": "en", "value": "The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links for arbitrary files stored inside project folders on the server, which can contain sensitive information. The authorization gate uses a negated nonce check OR-chained with permission checks, meaning a missing or invalid nonce causes the entire condition to evaluate to true and bypass all preceding capability and ownership checks. The secondary fallback check only denies access for root-level files (pid == 0), leaving all files stored inside project folders fully exposed to unauthenticated users who supply only a valid file ID in a POST request to admin-ajax.php."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-06-04T01:26:44.640Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10737", "state": "PUBLISHED", "dateUpdated": "2026-06-04T12:53:04.020Z", "dateReserved": "2026-06-03T13:00:59.355Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-06-04T01:26:44.640Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SP Project & Document Manager", "vendor": "smartypants", "versions": [{"lessThanOrEqual": "4.71", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links for arbitrary files stored inside project folders on the server, which can contain sensitive information. The authorization gate uses a negated nonce check OR-chained with permission checks, meaning a missing or invalid nonce causes the entire condition to evaluate to true and bypass all preceding capability and ownership checks. The secondary fallback check only denies access for root-level files (pid == 0), leaving all files stored inside project folders fully exposed to unauthenticated users who supply only a valid file ID in a POST request to admin-ajax.php."}, {"lang": "es", "value": "El plugin SP Project & Document Manager para WordPress es vulnerable a acceso no autorizado debido a una comprobaci\u00f3n de capacidad faltante en la funci\u00f3n view_file en todas las versiones hasta la 4.71, inclusive. Esto hace posible que atacantes no autenticados lean metadatos de archivos y obtengan enlaces de descarga para archivos arbitrarios almacenados dentro de carpetas de proyecto en el servidor, los cuales pueden contener informaci\u00f3n sensible. La puerta de autorizaci\u00f3n utiliza una comprobaci\u00f3n de nonce negada encadenada con comprobaciones de permisos, lo que significa que un nonce faltante o inv\u00e1lido hace que toda la condici\u00f3n se eval\u00fae como verdadera y omita todas las comprobaciones de capacidad y propiedad precedentes. La comprobaci\u00f3n de respaldo secundaria solo deniega el acceso para archivos de nivel ra\u00edz (pid == 0), dejando todos los archivos almacenados dentro de carpetas de proyecto completamente expuestos a usuarios no autenticados que solo proporcionan un ID de archivo v\u00e1lido en una solicitud POST a admin-ajax.php."}], "id": "CVE-2026-10737", "lastModified": "2026-07-22T20:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10737", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-04T12:52:52.947406Z", "version": "2.0.3"}}]}, "published": "2026-06-04T02:16:17.503", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/ajax.php#L155"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/ajax.php#L39"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/classes/ajax.php#L250"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2eafe150-2178-4355-88a8-67687bd446e4?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.71]"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "SP Project & Document Manager", "source": "cna", "vendor": "smartypants"}, "product": "sp_project_&_document_manager", "vendor": "smartypantsplugins"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "created": "2026-06-04T02:30:03.372123+00:00", "updated": "2026-06-05T07:45:35.658879+00:00", "vendors": ["smartypantsplugins", "smartypantsplugins$PRODUCT$sp_project_&_document_manager", "wordpress", "wordpress$PRODUCT$wordpress"]}