« Volver al listado

CVE-2026-10737

Estado: AplazadaAlta (7.5)—

The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links for arbitrary files stored inside project folders on the server, which can contain sensitive information.

Leer descripción completaMostrar menos

The authorization gate uses a negated nonce check OR-chained with permission checks, meaning a missing or invalid nonce causes the entire condition to evaluate to true and bypass all preceding capability and ownership checks. The secondary fallback check only denies access for root-level files (pid == 0), leaving all files stored inside project folders fully exposed to unauthenticated users who supply only a valid file ID in a POST request to admin-ajax.php.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso no autenticado a aplicación web expuesta (AV:N, PR:N, UI:N) mediante bypass de control de acceso. Lectura de metadatos y enlaces de descarga de archivos sensibles (C:H). CWE-862: Missing Authorization.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkVulnerability ScanningUser Account ManagementPassword Policies

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

SP Project Document Manager — SP Project Document ManagerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-10737",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-10737",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-04T12:52:52.947406Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@wordfence.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@wordfence.com",
      "affectedData": [
        {
          "vendor": "smartypants",
          "product": "SP Project & Document Manager",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "4.71"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-04T02:16:17.503",
  "references": [
    {
      "url": "https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/ajax.php#L155",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/ajax.php#L39",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/classes/ajax.php#L250",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2eafe150-2178-4355-88a8-67687bd446e4?source=cve",
      "source": "security@wordfence.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@wordfence.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links for arbitrary files stored inside project folders on the server, which can contain sensitive information. The authorization gate uses a negated nonce check OR-chained with permission checks, meaning a missing or invalid nonce causes the entire condition to evaluate to true and bypass all preceding capability and ownership checks. The secondary fallback check only denies access for root-level files (pid == 0), leaving all files stored inside project folders fully exposed to unauthenticated users who supply only a valid file ID in a POST request to admin-ajax.php."
    },
    {
      "lang": "es",
      "value": "El plugin SP Project & Document Manager para WordPress es vulnerable a acceso no autorizado debido a una comprobación de capacidad faltante en la función view_file en todas las versiones hasta la 4.71, inclusive. Esto hace posible que atacantes no autenticados lean metadatos de archivos y obtengan enlaces de descarga para archivos arbitrarios almacenados dentro de carpetas de proyecto en el servidor, los cuales pueden contener información sensible. La puerta de autorización utiliza una comprobación de nonce negada encadenada con comprobaciones de permisos, lo que significa que un nonce faltante o inválido hace que toda la condición se evalúe como verdadera y omita todas las comprobaciones de capacidad y propiedad precedentes. La comprobación de respaldo secundaria solo deniega el acceso para archivos de nivel raíz (pid == 0), dejando todos los archivos almacenados dentro de carpetas de proyecto completamente expuestos a usuarios no autenticados que solo proporcionan un ID de archivo válido en una solicitud POST a admin-ajax.php."
    }
  ],
  "lastModified": "2026-07-22T20:10:00.127",
  "sourceIdentifier": "security@wordfence.com"
}