WordPress SP Project & Document Manager plugin <= 4.71 - Directory Traversal vulnerability

The Directory Traversal vulnerability allows an attacker to bypass intended access restrictions and retrieve files from the server's file system. Successful exploitation could lead to the exposure of sensitive data such as configuration files, database credentials, or even source code. An attacker could leverage this to gain a deeper understanding of the application's architecture and identify further vulnerabilities. While the immediate impact is information disclosure, it could be a stepping stone for more severe attacks, such as code execution if sensitive files contain credentials or scripts.

Organizations using SP Project & Document Manager, particularly those running older versions (≤4.71) on shared hosting environments, are at increased risk. Sites with misconfigured file permissions or inadequate WAF protection are also more vulnerable.

• wordpress / composer / npm:

grep -r "../" /var/www/html/wp-content/plugins/sp-project-document-manager/*

• generic web:

curl -I 'http://your-wordpress-site.com/wp-content/uploads/../../../../etc/passwd' # Check for file disclosure

1. 2024-07-09Disclosure

   disclosure

1. Gereserveerd2024-06-04
2. Gepubliceerd2024-07-09
3. Gewijzigd2024-08-02
4. EPSS bijgewerkt2026-04-02

The primary mitigation is to upgrade SP Project & Document Manager to version 4.71.1 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to restrict access to sensitive files and directories. Specifically, block requests containing path traversal sequences like ../. Regularly review access logs for suspicious requests attempting to access files outside of the intended directory structure. Implement strict file permissions on the server to limit the impact of a successful attack.