CVE-2024-3749: Smartypantsplugins SP Project & Document Manager

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belonging to another user

Affected products

• Smartypantsplugins SP Project & Document Manager: before 4.71 (fixed in 4.71)

Published 2024-05-15. Last modified 2026-06-17.