CVE-2024-31118 PUBLISHED

WordPress SP Project & Document Manager plugin <= 4.70 - Broken Access Control to XSS vulnerability

Assigner: Patchstack
Reserved: 28.03.2024 Published: 17.02.2026 Updated: 17.02.2026

Missing Authorization vulnerability in Smartypants SP Project & Document Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SP Project & Document Manager: from n/a through 4.70.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS Score: 6.5

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	Low	Integrity Impact	Low
User Interaction	Required	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	Smartypants
Product	SP Project & Document Manager
Versions	Default: unaffected affected from n/a to 4.70 (incl.)

Credits

CatFather | Patchstack Bug Bounty Program finder

References

https://patchstack.com/database/wordpress/plugin/sp-client-document-manager/vulnerability/wordpress-sp-project-document-manager-plugin-4-70-broken-access-control-to-xss-vulnerability?_s_id=cve

Problem Types

CWE-862 Missing Authorization CWE

Impacts

CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels