The SP Project & Document Manager WordPress plugin through 4.71 is missing validation in its upload function, allowing a user to manipulate the user_id
to make it appear that a file was uploaded by another user
[
{
"vendor": "Unknown",
"product": "SP Project & Document Manager",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThanOrEqual": "4.71"
}
],
"defaultStatus": "affected"
}
]