CVE-2026-10737: SP Project & Document Manager <= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view_file() Function

Synopsis

Missing authorization check in the SP Project & Document Manager plugin for WordPress (versions up to and including 4.71) allows any unauthenticated attacker to read file metadata and retrieve download links for arbitrary files stored inside project folders. The flaw stems from a logic error in the view_file() function where a negated nonce check is OR-chained with permission checks, causing a missing or invalid nonce to bypass all capability and ownership verification entirely. Successful exploitation exposes sensitive project documents to anyone who can reach the WordPress site's admin-ajax.php endpoint and supply a valid file ID. No fix version has been published; HarborGuard tracks the upstream advisory and will make a patched rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to send an HTTP POST request to the target WordPress site's admin-ajax.php endpoint over the network; no LAN or physical proximity is required.

• AuthenticationNot required

  No account or credential of any kind is needed; supplying only a valid file ID in the POST body is sufficient to trigger the vulnerability.

• Victim interactionNot required

  The attack is entirely server-side; no user needs to click a link, open a file, or take any other action for exploitation to succeed.

• Attack complexityDetail

  Exploitation is reliable and condition-free, requiring only knowledge of a valid file ID; no race conditions or special environmental factors apply.

Blast Radius

• Attacker retrieves metadata (file names, paths, ownership details) for any file stored inside project folders on the WordPress server.
• Attacker obtains direct download links for those files, enabling them to exfiltrate documents such as contracts, invoices, internal reports, or credentials stored in project directories.
• Sensitive information exposed through downloaded files can be used for follow-on attacks such as credential stuffing, social engineering, or targeted phishing.