CVE-2021-4225
High
Description
The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plugin attempts to prevent PHP and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that on Windows servers, the security checks in place were insufficient, enabling bad actors to potentially upload backdoors on vulnerable sites.
SeverityHigh
CVSS8.8
Exploit probability—
ProductSmartypantsplugins Sp Project \& Document Manager
PublishedApr 25, 2022
First seenApr 25, 2022
Weakness typeCWE-434Unrestricted upload of dangerous file type
How to fix
Update
- smartypantsplugins sp_project_\&_document_manager4.24 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| smartypantsplugins sp_project_\&_document_manager | v < 4.24 | 4.24 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.