The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users sensitive files.
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Sp_project_&_document_manager | Smartypantsplugins | * | 4.58 (excluding) |