CVE-2024-3748: Smartypantsplugins SP Project & Document Manager

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

The SP Project & Document Manager WordPress plugin through 4.71 is missing validation in its upload function, allowing a user to manipulate the `user_id` to make it appear that a file was uploaded by another user

Affected products

• Smartypantsplugins SP Project & Document Manager: up to and including 4.71

Published 2024-05-15. Last modified 2026-06-17.