CVE-2024-3748

🗓️ 15 May 2024 06:00:04Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 71 Views🌐 WEB

The SP Project & Document Manager WordPress plugin allows user ID manipulatio

Reporter	Title	Published	Views	Family All 10
Cvelist	CVE-2024-3748 SP Project & Document Manager <= 4.71 - Data Update via IDOR	15 May 202406:00	–	cvelist
NVD	CVE-2024-3748	15 May 202406:15	–	nvd
OSV	CVE-2024-3748	15 May 202406:15	–	osv
Patchstack	WordPress SP Project & Document Manager Plugin <= 4.71 is vulnerable to Insecure Direct Object References (IDOR)	15 May 202400:00	–	patchstack
Patchstack	WordPress SP Project & Document Manager plugin <= 4.71 - Data Update and File Download via IDOR vulnerability	15 May 202407:00	–	patchstack
Positive Technologies	PT-2024-27588 · WordPress · Sp Project & Document Manager	15 May 202400:00	–	ptsecurity
Vulnrichment	CVE-2024-3748 SP Project & Document Manager <= 4.71 - Data Update via IDOR	15 May 202406:00	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (April 22, 2024 to April 28, 2024)	2 May 202414:49	–	wordfence
wpexploit	SP Project & Document Manager <= 4.71 - Data Update via IDOR	24 Apr 202400:00	–	wpexploit
WPVulnDB	SP Project & Document Manager <= 4.71 - Data Update via IDOR	24 Apr 202400:00	–	wpvulndb

NVD

Vulners

Vulnrichment

Node

smartypantsplugins sp_project_&_document_managerRange≤4.71wordpress

[
  {
    "vendor": "Unknown",
    "product": "SP Project & Document Manager",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThanOrEqual": "4.71"
      }
    ],
    "defaultStatus": "affected"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/01427cfb-5c51-4524-9b9d-e09a603bc34c/

Parameter	Position	Path	Description
uid	request body	sp_file_upload_callback	Upload function allows manipulation of uid to impersonate another user during file upload.
file[]	request body	sp_file_upload_callback	Upload function allows manipulation of uid to impersonate another user during file upload.
action	request body	sp_file_upload_callback	Upload function allows manipulation of uid to impersonate another user during file upload.
uid	request body	sp_cdm_link_save_embed	Link/embed save also accepts manipulated uid/pid to impersonate user during embedding/link creation.
pid	request body	sp_cdm_link_save_embed	Link/embed save also accepts manipulated uid/pid to impersonate user during embedding/link creation.
action	request body	sp_cdm_link_save_embed	Link/embed save also accepts manipulated uid/pid to impersonate user during embedding/link creation.
link-name	request body	sp_cdm_link_save_embed	Link/embed save also accepts manipulated uid/pid to impersonate user during embedding/link creation.
link-url	request body	sp_cdm_link_save_embed	Link/embed save also accepts manipulated uid/pid to impersonate user during embedding/link creation.

17 Jun 2026 07:44Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.16.5

EPSS0.00434

SSVC

sp project document manager wordpress user id manipulation validation upload function nvd