The SP Project & Document Manager WordPress plugin contains a missing capability check in the view_file function, allowing the authorization gate to accept a negated nonce check OR‑chained with permission checks. An unauthenticated attacker can send a valid file ID to admin-ajax.php and trigger view_file(), which bypasses both capability and ownership checks. This enables the attacker to read metadata and obtain download links for any file stored inside project folders, exposing potentially sensitive information without needing authentication.

All released versions of the SP Project & Document Manager plugin for WordPress up to and including version 4.71 are affected. The vulnerability applies to every installation of these versions and persists until the plugin is updated beyond 4.71.

The flaw carries a CVSS score of 7.5, indicating a high severity. The EPSS score is currently unavailable, but the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by crafting a simple POST request to admin-ajax.php with a file ID, requiring no authentication or additional privileges. The missing authorization check makes exploitation straightforward, and the ability to retrieve arbitrary file links or metadata poses a significant confidentiality risk to users and site administrators.