The SP Project & Document Manager WordPress plugin through 4.71 is missing validation in its upload function, allowing a user to manipulate the `user_id` to make it appear that a file was uploaded by another user
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/01427cfb-5c51-4524-9b9d-e09a603bc34c/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/01427cfb-5c51-4524-9b9d-e09a603bc34c/ | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
15 May 2025, 13:50
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo | |
| References | () https://wpscan.com/vulnerability/01427cfb-5c51-4524-9b9d-e09a603bc34c/ - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:smartypantsplugins:sp_project_\&_document_manager:*:*:*:*:*:wordpress:*:* | |
| First Time |
Smartypantsplugins sp Project \& Document Manager
Smartypantsplugins |
21 Nov 2024, 09:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/01427cfb-5c51-4524-9b9d-e09a603bc34c/ - |
03 Jul 2024, 02:06
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
15 May 2024, 16:40
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-15 06:15
Updated : 2025-05-15 13:50
NVD link : CVE-2024-3748
Mitre link : CVE-2024-3748
CVE.ORG link : CVE-2024-3748
JSON object : View
Products Affected
smartypantsplugins
- sp_project_\&_document_manager
CWE